CVE-2018-2628: Oracle WebLogic Server Remote Code Execution Vulnerability

by do son ·

CVE-2018-2628

On April 18, Oracle official released in April Critical Patch Update, which contains a high-risk Weblogic deserialization vulnerability (CVE-2018-2628), Through this vulnerability, an attacker can remotely execute code without authorization.

This vulnerability was first discovered by Liao Xinxi of NSFOCUS Security Team.

Affected version

  • Weblogic 10.3.6.0
  • Weblogic 12.1.3.0
  • Weblogic 12.2.1.2
  • Weblogic 12.2.1.3

Solution

Oracle officially fixed this vulnerability in today’s Critical Patch Update, and it is highly recommended that affected users upgrade as soon as possible to protect against the vulnerability.

Note: Oracle official patch requires the user to hold a licensed account of genuine software. After using this account to log in to https://support.oracle.com, you can download the latest patch.

Tags: CVE-2018-2628