Vulnerabilities > CVE-2016-0638 - Unspecified vulnerability in Oracle Weblogic Server

047910
CVSS 9.8 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
oracle
critical
nessus
NVD
Published: 2016-04-21
Updated: 2024-11-21

Summary

Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Messaging Service.

Vulnerable Configurations

Part Description Count
Application
Oracle
4

Nessus

NASL familyWeb Servers
NASL idWEBLOGIC_2016_0638.NASL
descriptionThe remote Oracle WebLogic Server is affected by a remote code execution vulnerability in the Java Messaging Service subcomponent in the readExternal() function due to improper sanitization of user-supplied input. An unauthenticated, remote attacker can exploit this, via a crafted object payload, to bypass the ClassFilter.class blacklist and execute arbitrary Java code in the context of the WebLogic server.
last seen2020-06-01
modified2020-06-02
plugin id90709
published2016-04-26
reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/90709
titleOracle WebLogic Server Java Object Deserialization RCE (April 2016 CPU)

References