CVE-2018-2894

🗓️ 18 Jul 2018 13:00:29Reported by oracleType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 239 Views🌐 WEB

Vulnerability in Oracle WebLogic Server allows takeover. CVSS 3.0 Base Score 9.

Reporter	Title	Published	Views	Family All 16
NVD	CVE-2018-2894	18 Jul 201813:29	–	nvd
Nuclei	Oracle WebLogic Server - Remote Code Execution	10 Apr 202113:44	–	nuclei
Check Point Advisories	Oracle WebLogic WLS Server Component Arbitrary File Upload (CVE-2018-2894)	24 Jul 201800:00	–	checkpoint_advisories
seebug.org	WebLogic 任意文件上传漏洞(CVE-2018-2894)	19 Jul 201800:00	–	seebug
Dsquare	Oracle WebLogic Server WLS File Upload	22 Jul 201800:00	–	dsquare
Cvelist	CVE-2018-2894	18 Jul 201813:00	–	cvelist
Prion	Design/Logic Flaw	18 Jul 201813:29	–	prion
Vulnrichment	CVE-2018-2894	18 Jul 201813:00	–	vulnrichment
GithubExploit	Exploit for Vulnerability in Oracle Weblogic Server	19 Nov 201916:51	–	githubexploit
GithubExploit	Exploit for CVE-2014-4210	19 Mar 202201:54	–	githubexploit

Nvd

Vulners

Node

oracle weblogic_serverMatch10.3.6.0.0

oracle weblogic_serverMatch12.1.3.0.0

oracle weblogic_serverMatch12.2.1.2.0

oracle weblogic_serverMatch12.2.1.3

[
  {
    "product": "WebLogic Server",
    "vendor": "Oracle Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "12.1.3.0"
      },
      {
        "status": "affected",
        "version": "12.2.1.2"
      },
      {
        "status": "affected",
        "version": "12.2.1.3"
      }
    ]
  }
]

Source	Link
oracle	www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
securityfocus	www.securityfocus.com/bid/104763
securitytracker	www.securitytracker.com/id/1041301

Parameter	Position	Path	Description	CWE
timestamp	path	/ws_utc/config/keystore/{timestamp}_chybeta.jsp	Arbitrary file upload leading to JSP execution, potentially allowing for remote code execution.	CWE-434, CWE-78

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

18 Jul 2018 13:29Current

9.1High risk

Vulners AI Score9.1

CVSS27.5

CVSS39.8

EPSS0.97327

SSVC