CISA includes Oracle WebLogic Server flaw in its List of Actively Exploited Vulnerabilities

Pierluigi Paganini
June 03, 2024

CISA adds Oracle WebLogic Server vulnerability due to OS command injection to its List of Actively Exploited Vulnerabilities.

The US Cybersecurity and Infrastructure Security Agency (CISA) included an Oracle WebLogic Server vulnerability in its List of Actively Exploited Vulnerabilities (LAEV).

The bug, known as CVE-2017-3506 (CVSS score 7.4), represents an OS command injection flaw.

This vulnerability is found in the Oracle WebLogic Server component of Oracle Fusion Middleware. It affects versions 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1, and 12.2.1.2. A malicious attacker without authentication but with network access can misuse the flaw via HTTP to compromise Oracle WebLogic Server.

If this vulnerability is successfully exploited, it could result in unauthorized creation, deletion, or alteration of vital data, as well as unauthorized entry to all data reachable through the Oracle WebLogic Server.

As per Binding Operational Directive (BOD) 22-01: Decreasing the Significant Risk of Actively Exploited Vulnerabilities, federal civilian executive branch (FCEB) institutions must address the identified vulnerabilities by the specified deadline to safeguard their networks against attacks exploiting the weaknesses listed in the catalog.

Specialists also advise private organizations to check the List and rectify the vulnerabilities present in their system infrastructure.

CISA instructs federal entities to resolve these vulnerabilities before June 24, 2024.

Pierluigi Paganini

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

(SecurityAffairs – hacking, Actively Exploited Vulnerabilities list)

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts