PT-2015-2734 · Oracle+3 · Oracle Weblogic Server+3

Aaron Soto + 1 · Publicado 2015-11-18 · Atualizado 2025-07-27 · CVE-2015-4852

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server versions 10.3.6.0 through 12.2.1.0

Description The issue allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle common/modules/com.bea.core.apache.commons.collections.jar. This is due to the lack of input data sanitization measures in the WLS Security component.

Recommendations For Oracle WebLogic Server versions 10.3.6.0 through 12.2.1.0, consider disabling the deserialization of untrusted data as a temporary workaround until a patch is available. Restrict access to the oracle common/modules/com.bea.core.apache.commons.collections.jar module to minimize the risk of exploitation. Avoid using the T3 protocol with untrusted input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Deserialization of Untrusted Data

Command Injection

Enumeração de Fraquezas

CWE-502

CWE-77

Identificadores relacionados

BDU:2015-12099

CVE-2015-4852

OPENSUSE-SU-2024:10617-1

SUSE-SU-2025:02056-1

SUSE-SU-2025_02056-1

USN-6936-1

Produtos afetados

Apache Commons Collections

Oracle Weblogic Server

Suse

Ubuntu

Referências · 54

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts_code_exec_classloader.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/weblogic_deserialize_rawobject.rb · Exploit
• 🔥 https://github.com/foxglovesec/JavaUnserializeExploits/blob/master/weblogic.py · Exploit
• 🔥 https://github.com/roo7break/serialator · Exploit
• 🔥 https://github.com/zhzhdoai/Weblogic_Vuln · Exploit
• 🔥 https://github.com/AndersonSingh/serialization-vulnerability-scanner · Exploit
• 🔥 https://exploit-db.com/exploits/44552 · Exploit
• 🔥 https://exploit-db.com/exploits/46628 · Exploit
• 🔥 https://exploit-db.com/exploits/42806 · Exploit
• 🔥 http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability · Exploit
• 🔥 http://packetstormsecurity.com/files/152268/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html · Exploit
• http://oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.html · Aviso do Fabricante
• http://securityfocus.com/bid/77539 · Nota
• https://oracle.com/security-alerts/cpuapr2017.html · Nota
• https://kb.cert.org/vuls/id/576313 · Nota