CrowdSecLive Exploit Tracker
Background NoiseCVE-2017-3506Public Exploit

Oracle WebLogic - RCE (CVE-2017-3506)

PublishedApr 24, 2017
First SeenNov 23, 2024
Last Seen
Reported
CVSS7.4
Oracle
OracleWebLogic Server
enterprise_softwarejava

Description

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data as well as unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

psychologyCrowdSec Analysis

CVE-2017-3506 is a vulnerability in Oracle WebLogic Server that can allow unauthenticated attackers to gain unauthorized access and potentially create, delete, or modify critical data within the server.

CrowdSec has been tracking this vulnerability and its exploits since 13th of June 2024.

CrowdSec network data shows that most actors exploiting CVE-2017-3506 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2017-3506 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2017-3506 is currently experiencing high visibility and active exploitation across the internet.

Exploitation attempts typically involve requests to URLs containing /wls-wsat/registrationrequesterporttype, /wls-wsat/coordinatorporttype, or /wls-wsat/coordinatorporttype11.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2017-04-24
CISA KEV2024-06-03
Rule Released2024-06-13
CISA Remediation Deadline2024-06-24
CrowdSec First Seen2024-11-23

Related Weaknesses

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References