--- licence_title: Creative Commons Attribution 4.0 International (CC-BY 4.0) licence_link: https://creativecommons.org/licenses/by/4.0/ licence_restrictions: https://cert.europa.eu/legal-notice licence_author: CERT-EU, The Cybersecurity Service for the European Union institutions, bodies, offices and agencies title: 'WebLogic Vulnerability Exploited In The Wild' version: '1.0' number: '2018-018' date: 'July 26, 2018' --- _History:_ * _26/07/2018 --- v1.0: Initial publication_ # Summary Recently Oracle released patches for vulnerability CVE-2018-2893. This vulnerability allows an unauthenticated attacker to compromise Oracle WebLogic Server. Exploits were published on GitHub and on other websites after the announcement of the security updates. There were reported attacks against vulnerable instances. # Technical Details On the 18th of July 2018, Oracle released patches for vulnerability CVE-2018-2893 with an assigned CVSS score of 9.8. [1] The vulnerability allows an unauthenticated attacker to remotely take control of a WebLogic Server. [1] Details about this vulnerability were never made public by Oracle but only the patches. Exploits were published on GitHub and on other websites after the announced of the security updates. [2],[3],[4],[5] There were reported attacks against vulnerable instances. [6],[7] # Products Affected Oracle WebLogic servers running versions 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3 are known to be vulnerable. # Recommendations * Apply the Oracle July 2018 updates as soon as possible, and especially the patches for CVE-2018-2893. * Block external access to port 7001 as the flaw is exploited via this port. * Use detection rules in monitoring devices as fore example sigma rule in [8]. # References [1] [2] [3] [4] [5] [6] [7] [8]