{"api_version":"1","generated_at":"2026-07-23T06:16:04+00:00","cve":"CVE-2017-3248","urls":{"html":"https://cve.report/CVE-2017-3248","api":"https://cve.report/api/cve/CVE-2017-3248.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2017-3248","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-3248"},"summary":{"title":"CVE-2017-3248","description":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0 and 12.2.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS v3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).","state":"PUBLISHED","assigner":"oracle","published_at":"2017-01-27 22:59:02","updated_at":"2025-08-13 15:15:29"},"problem_types":["NVD-CWE-noinfo","CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www.securityfocus.com/bid/95465","name":"http://www.securityfocus.com/bid/95465","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Oracle WebLogic Server CVE-2017-3248 Remote Security Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.vicarius.io/vsociety/posts/cve-2017-3248-mitigate-centos-weblogic-rce","name":"https://www.vicarius.io/vsociety/posts/cve-2017-3248-mitigate-centos-weblogic-rce","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"http://packetstormsecurity.com/files/152357/Oracle-Weblogic-Server-Deserialization-RMI-UnicastRef-Remote-Code-Execution.html","name":"http://packetstormsecurity.com/files/152357/Oracle-Weblogic-Server-Deserialization-RMI-UnicastRef-Remote-Code-Execution.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Oracle Weblogic Server Deserialization RMI UnicastRef Remote Code Execution ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.vicarius.io/vsociety/posts/cve-2017-3248-detect-centos-weblogic-rce","name":"https://www.vicarius.io/vsociety/posts/cve-2017-3248-detect-centos-weblogic-rce","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.exploit-db.com/exploits/44998/","name":"https://www.exploit-db.com/exploits/44998/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Oracle WebLogic 12.1.2.0 - RMI Registry UnicastRef Object Java Deserialization Remote Code Execution - Multiple webapps Exploit","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html","name":"http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Oracle Critical Patch Update - January 2017","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1037632","name":"http://www.securitytracker.com/id/1037632","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Oracle WebLogic Unspecified Flaw in Core Components Lets Remote Users Gain Elevated Privileges - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.tenable.com/security/research/tra-2017-07","name":"https://www.tenable.com/security/research/tra-2017-07","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[R1] Oracle WebLogic RMI Registry UnicastRef Object Java Deserialization Remote Code Execution - Research Advisory | Tenable™","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-3248","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3248","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Oracle","product":"WebLogic Server","version":"affected 10.3.6.0","platforms":[]},{"source":"CNA","vendor":"Oracle","product":"WebLogic Server","version":"affected 12.1.3.0","platforms":[]},{"source":"CNA","vendor":"Oracle","product":"WebLogic Server","version":"affected 12.2.1.0","platforms":[]},{"source":"CNA","vendor":"Oracle","product":"WebLogic Server","version":"affected 12.2.1.1","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2017","cve_id":"3248","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"weblogic_server","cpe6":"10.3.6.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"3248","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"weblogic_server","cpe6":"12.1.3.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"3248","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"weblogic_server","cpe6":"12.2.1.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"3248","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"weblogic_server","cpe6":"12.2.1.1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2025-08-13T14:25:23.690Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"url":"https://www.vicarius.io/vsociety/posts/cve-2017-3248-detect-centos-weblogic-rce"},{"url":"https://www.vicarius.io/vsociety/posts/cve-2017-3248-mitigate-centos-weblogic-rce"},{"name":"44998","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/44998/"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://www.tenable.com/security/research/tra-2017-07"},{"name":"95465","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/95465"},{"name":"1037632","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1037632"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.com/files/152357/Oracle-Weblogic-Server-Deserialization-RMI-UnicastRef-Remote-Code-Execution.html"}],"title":"CVE Program Container","x_generator":{"engine":"ADPogram 0.0.1"}},{"metrics":[{"other":{"content":{"id":"CVE-2017-3248","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2024-10-09T19:21:08.198036Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2024-10-09T19:48:41.075Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"WebLogic Server","vendor":"Oracle","versions":[{"status":"affected","version":"10.3.6.0"},{"status":"affected","version":"12.1.3.0"},{"status":"affected","version":"12.2.1.0"},{"status":"affected","version":"12.2.1.1"}]}],"datePublic":"2017-01-17T00:00:00.000Z","descriptions":[{"lang":"en","value":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0 and 12.2.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS v3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts)."}],"problemTypes":[{"descriptions":[{"description":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2019-04-02T16:06:13.000Z","orgId":"43595867-4340-4103-b7a2-9a5208d29a85","shortName":"oracle"},"references":[{"name":"44998","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/44998/"},{"tags":["x_refsource_MISC"],"url":"https://www.tenable.com/security/research/tra-2017-07"},{"name":"95465","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/95465"},{"name":"1037632","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1037632"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.com/files/152357/Oracle-Weblogic-Server-Deserialization-RMI-UnicastRef-Remote-Code-Execution.html"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"secalert_us@oracle.com","ID":"CVE-2017-3248","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"WebLogic Server","version":{"version_data":[{"version_value":"10.3.6.0"},{"version_value":"12.1.3.0"},{"version_value":"12.2.1.0"},{"version_value":"12.2.1.1"}]}}]},"vendor_name":"Oracle"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0 and 12.2.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS v3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts)."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}]},"references":{"reference_data":[{"name":"44998","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/44998/"},{"name":"https://www.tenable.com/security/research/tra-2017-07","refsource":"MISC","url":"https://www.tenable.com/security/research/tra-2017-07"},{"name":"95465","refsource":"BID","url":"http://www.securityfocus.com/bid/95465"},{"name":"1037632","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1037632"},{"name":"http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html","refsource":"CONFIRM","url":"http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html"},{"name":"http://packetstormsecurity.com/files/152357/Oracle-Weblogic-Server-Deserialization-RMI-UnicastRef-Remote-Code-Execution.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/152357/Oracle-Weblogic-Server-Deserialization-RMI-UnicastRef-Remote-Code-Execution.html"}]}}}},"cveMetadata":{"assignerOrgId":"43595867-4340-4103-b7a2-9a5208d29a85","assignerShortName":"oracle","cveId":"CVE-2017-3248","datePublished":"2017-01-27T22:01:00.000Z","dateReserved":"2016-12-06T00:00:00.000Z","dateUpdated":"2025-08-13T14:25:23.690Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2017-01-27 22:59:02","lastModifiedDate":"2025-08-13 15:15:29","problem_types":["NVD-CWE-noinfo","CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*","matchCriteriaId":"B40B13B7-68B3-4510-968C-6A730EB46462"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*","matchCriteriaId":"C93CC705-1F8C-4870-99E6-14BF264C3811"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:weblogic_server:12.2.1.0.0:*:*:*:*:*:*:*","matchCriteriaId":"9F57085F-A922-421B-BD10-ECC4F3CB34C2"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:weblogic_server:12.2.1.1.0:*:*:*:*:*:*:*","matchCriteriaId":"29F4C533-DE42-463B-9D80-5D4C85BF1A5B"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2017","CveId":"3248","Ordinal":"1","Title":"CVE-2017-3248","CVE":"CVE-2017-3248","Year":"2017"},"notes":[{"CveYear":"2017","CveId":"3248","Ordinal":"1","NoteData":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0 and 12.2.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS v3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).","Type":"Description","Title":"CVE-2017-3248"},{"CveYear":"2017","CveId":"3248","Ordinal":"2","NoteData":"2017-01-27","Type":"Other","Title":"Published"},{"CveYear":"2017","CveId":"3248","Ordinal":"3","NoteData":"2019-04-02","Type":"Other","Title":"Modified"}]}}}