CVE-2015-4852

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 96,0%

Kerentanan Deserialization of Untrusted Data pada oracle virtual desktop infrastructure, oracle storagetek tape analytics sw tool +1 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 3 November 2021, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.

Rincian

Terbit di NVD

18 November 2015

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

96,0% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability

Masuk KEV

3 November 2021

Tenggat CISA

3 Mei 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html patch · advisory vendor
• http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html patch · advisory vendor
• http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html patch · advisory vendor
• http://www.oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.html advisory vendor
• http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html patch · advisory vendor
• http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html patch
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-4852 pemerintah AS
• http://packetstormsecurity.com/files/152268/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
• http://www.openwall.com/lists/oss-security/2015/11/17/19 mailing list · advisory pihak ketiga
• https://www.exploit-db.com/exploits/42806/ exploit · advisory pihak ketiga · vdb entry
• https://www.exploit-db.com/exploits/46628/ exploit · advisory pihak ketiga · vdb entry
• http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-h... exploit
• http://www.securityfocus.com/bid/77539 broken link
• http://www.securitytracker.com/id/1038292 broken link
• https://blogs.oracle.com/security/entry/security_alert_cve_2015_4852 broken link
• https://github.com/foxglovesec/JavaUnserializeExploits/blob/master/weblogic.py product