PT-2015-2734 · Oracle+3 · Oracle Weblogic Server+3

Aaron Soto + 1 · Published 2015-11-18 · Updated 2025-07-27 · CVE-2015-4852

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server versions 10.3.6.0 through 12.2.1.0

Description The issue allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle common/modules/com.bea.core.apache.commons.collections.jar. This is due to the lack of input data sanitization measures in the WLS Security component.

Recommendations For Oracle WebLogic Server versions 10.3.6.0 through 12.2.1.0, consider disabling the deserialization of untrusted data as a temporary workaround until a patch is available. Restrict access to the oracle common/modules/com.bea.core.apache.commons.collections.jar module to minimize the risk of exploitation. Avoid using the T3 protocol with untrusted input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Deserialization of Untrusted Data

Command Injection

Weakness Enumeration

CWE-502

CWE-77

Related Identifiers

BDU:2015-12099

CVE-2015-4852

OPENSUSE-SU-2024:10617-1

SUSE-SU-2025:02056-1

SUSE-SU-2025_02056-1

USN-6936-1

Affected Products

Apache Commons Collections

Oracle Weblogic Server

Suse

Ubuntu

References · 54

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts_code_exec_classloader.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/weblogic_deserialize_rawobject.rb · Exploit
• 🔥 https://github.com/foxglovesec/JavaUnserializeExploits/blob/master/weblogic.py · Exploit
• 🔥 https://github.com/roo7break/serialator · Exploit
• 🔥 https://github.com/zhzhdoai/Weblogic_Vuln · Exploit
• 🔥 https://github.com/AndersonSingh/serialization-vulnerability-scanner · Exploit
• 🔥 https://exploit-db.com/exploits/44552 · Exploit
• 🔥 https://exploit-db.com/exploits/46628 · Exploit
• 🔥 https://exploit-db.com/exploits/42806 · Exploit
• 🔥 http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability · Exploit
• 🔥 http://packetstormsecurity.com/files/152268/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html · Exploit
• http://oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10617-1 · Vendor Advisory
• http://oracle.com/technetwork/security-advisory/cpujan2018-3236628.html · Vendor Advisory
• http://oracle.com/technetwork/topics/security/cpujan2016-2367955.html · Vendor Advisory