CVE-2015-4852

Published: Nov 18, 2015Modified: Apr 21, 2026CISA KEV

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.

Affected (6)

Products: Oracle: Virtual Desktop Infrastructure, Storagetek Tape Analytics Sw Tool, Weblogic Server

3 products

Virtual Desktop Infrastructure

Storagetek Tape Analytics Sw Tool

Weblogic Server

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Oracle Virtual Desktop Infrastructure	Up to 3.5.2

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Oracle Storagetek Tape Analytics Sw Tool	Version 2.3
Oracle Weblogic Server	Version 10.3.6.0.0
Oracle Weblogic Server	Version 12.1.2.0.0
Oracle Weblogic Server	Version 12.1.3.0.0
Oracle Weblogic Server	Version 12.2.1.0.0

Related CWEs

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (31)

http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/

Source: secalert_us@oracle.com

Exploit

http://packetstormsecurity.com/files/152268/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html

Source: secalert_us@oracle.com

ExploitThird Party AdvisoryVDB Entry

http://www.openwall.com/lists/oss-security/2015/11/17/19

Source: secalert_us@oracle.com

Mailing ListThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html

Source: secalert_us@oracle.com

Patch

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Source: secalert_us@oracle.com

PatchVendor Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

Source: secalert_us@oracle.com

PatchVendor Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: secalert_us@oracle.com

PatchVendor Advisory

http://www.oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.html

Source: secalert_us@oracle.com

Vendor Advisory

http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

Source: secalert_us@oracle.com

PatchVendor Advisory

http://www.securityfocus.com/bid/77539

Source: secalert_us@oracle.com

Broken Link

http://www.securitytracker.com/id/1038292

Source: secalert_us@oracle.com

Broken Link

https://blogs.oracle.com/security/entry/security_alert_cve_2015_4852

Source: secalert_us@oracle.com

Broken Link

https://github.com/foxglovesec/JavaUnserializeExploits/blob/master/weblogic.py

Source: secalert_us@oracle.com

Product

https://www.exploit-db.com/exploits/42806/

Source: secalert_us@oracle.com

ExploitThird Party AdvisoryVDB Entry

https://www.exploit-db.com/exploits/46628/

Source: secalert_us@oracle.com

ExploitThird Party AdvisoryVDB Entry

http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://packetstormsecurity.com/files/152268/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

http://www.openwall.com/lists/oss-security/2015/11/17/19

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.securityfocus.com/bid/77539

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

http://www.securitytracker.com/id/1038292

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

https://blogs.oracle.com/security/entry/security_alert_cve_2015_4852

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

https://github.com/foxglovesec/JavaUnserializeExploits/blob/master/weblogic.py

Source: af854a3a-2127-422b-91ae-364da2661108

Product

https://www.exploit-db.com/exploits/42806/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

https://www.exploit-db.com/exploits/46628/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-4852

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

Timeline

No history available yet.