Exploit for #VU9816 Deserialization of Untrusted Data in Oracle WebLogic Server

Vulnerability identifier: #VU9816

Vulnerability risk: Critical

CVSSv4.0: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]

CVE-ID: CVE-2017-3506

CWE-ID: CWE-502

Exploitation vector: Network

Exploits in database: 5

• April 7, 2020
  • Oracle-WebLogic-WLS-WSAT (Oracle WebLogic WLS-WSAT Remote Code Execution Exploit (CVE-2017-10271)) [Github]
  • CVE-2017-10271 (Oracle WebLogic WLS-WSAT Remote Code Execution Exploit (CVE-2017-10271)) [Github]
  • exphub (Exphub[漏洞利用脚本库] 包括Webloigc、Struts2、Tomcat、Nexus、Solr、Jboss、Drupal的漏洞利用脚本，最新添加CVE-2020-14882、CVE-2020-11444、CVE-2020-10204、CVE-2020-10199、CVE-2020-1938、CVE-2020-2551、CVE-2020-2555、CVE-2020-2883、CVE-2019-17558、CVE-2019-6340) [Github]
• March 18, 2020
  • CVE-2017-10271 (Oracle WebLogic WLS-WSAT Remote Code Execution Exploit (CVE-2017-10271)) [Github]
  • CVE-2019-2725 (WebLogic Insecure Deserialization - CVE-2019-2725 payload builder & exploit ) [Github]

Vulnerable software:
Oracle WebLogic Server
Server applications / Application servers

Vendor: Oracle