CVE-2017-10271
CVE-2017-10271
Em resumo
O Oracle WebLogic Server possui uma falha de segurança que permite a atacantes desabilitar ou derrubar o servidor sem precisar de senha. Um atacante precisa apenas de acesso à rede para explorar isso, tornando-se uma ameaça séria.
Detalhe técnico
Vulnerabilidade de execução remota sem autenticação no Oracle WebLogic Server (versões 10.3.6, 12.1.3, 12.2.1.1, 12.2.1.2) acessível via protocolo T3 sem exigir credenciais ou interação do usuário. A exploração bem-sucedida resulta em negação de serviço com alto impacto na disponibilidade; a falha existe no subcomponente WLS Security devido à ausência de controles de autenticação (CWE-306).
Resumo gerado e traduzido por IA a partir da descrição oficial.
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
Oracle Corporation · WebLogic ServerPoCs públicas encontradas — 34
githubgithub.com/shack2/javaserializetools★ 515githubgithub.com/c0mmand3rOpSec/CVE-2017-10271★ 143githubgithub.com/kkirsche/CVE-2017-10271★ 129githubgithub.com/7kbstorm/WebLogic_CNVD_C2019_48814★ 114githubgithub.com/SkyBlueEternal/CNVD-C-2019-48814-CNNVD-201904-961★ 105githubgithub.com/1337g/CVE-2017-10271★ 39githubgithub.com/Cymmetria/weblogic_honeypot★ 33githubgithub.com/Luffin/CVE-2017-10271★ 29githubgithub.com/s3xy/CVE-2017-10271★ 22githubgithub.com/ETOCheney/JavaDeserialization★ 9githubgithub.com/SuperHacker-liuan/cve-2017-10271-poc★ 7githubgithub.com/pssss/CVE-2017-10271★ 5githubgithub.com/kbsec/Weblogic_Wsat_RCE★ 4githubgithub.com/cjjduck/weblogic_wls_wsat_rce★ 3githubgithub.com/ZH3FENG/PoCs-Weblogic_2017_10271★ 3githubgithub.com/pizza-power/weblogic-CVE-2019-2729-POC★ 3githubgithub.com/ianxtianxt/-CVE-2017-10271-★ 2githubgithub.com/Al1ex/CVE-2017-10271★ 2githubgithub.com/lonehand/Oracle-WebLogic-CVE-2017-10271-master★ 1githubgithub.com/XHSecurity/Oracle-WebLogic-CVE-2017-10271★ 1githubgithub.com/JackyTsuuuy/weblogic_wls_rce_poc-exp★ 1githubgithub.com/Yuusuke4/WebLogic_CNVD_C_2019_48814★ 1githubgithub.com/r4b3rt/CVE-2017-10271★ 0githubgithub.com/peterpeter228/Oracle-WebLogic-CVE-2017-10271★ 0githubgithub.com/cved-sources/cve-2017-10271★ 0githubgithub.com/testwc/CVE-2017-10271★ 0githubgithub.com/KKsdall/7kbstormq★ 0githubgithub.com/seoyoung-kang/CVE-2017-10271★ 0githubgithub.com/Dungsocool/CVE-2017-10271★ 0exploitdbwww.exploit-db.com/exploits/43458não verificadoexploitdbwww.exploit-db.com/exploits/43392não verificadocve_referencewww.exploit-db.com/exploits/43924/não verificadocve_referencewww.exploit-db.com/exploits/43458/não verificadoexploitdbwww.exploit-db.com/exploits/43924não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Quer saber se a sua infraestrutura está exposta a isto?
Falar com a TrueHacking →Referências
https://github.com/c0mmand3rOpSec/CVE-2017-10271https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-10271https://www.exploit-db.com/exploits/43458/https://www.exploit-db.com/exploits/43924/http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlhttp://www.securityfocus.com/bid/101304http://www.securitytracker.com/id/1039608