QID 87448

Oracle WebLogic Server (formerly known as BEA WebLogic Server) is an application server for building and deploying enterprise applications and services.
The Oracle WebLogic Server component in Oracle Fusion Middleware for versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0 has fixes for multiple vulnerabilities.

Affected Versions:
Oracle WebLogic Server, version(s) 10.3.6.0, 12.1.3.0, 12.2.1.3,12.2.1.4 and 14.1.1.0

QID Detection Logic (Authenticated):
Operating System: Linux
This QID checks to see if Oracle WebLogic Server process is listening on any of the TCP ports. If so, for version 12.x it gets the "Oracle_Home" path, navigates to that directory and reads "registry.xml" and the patch files found in the directory "Oracle_Home"\inventory\patches to check if the installed version is patched.
For version 10.3.6.x, it gets the "Oracle_Home" path, navigates to that directory and reads "registry.xml" and the file "Oracle_Home"\patch_wls1036\registry\patch-registry.xml to check if the installed version is patched.

QID Detection Logic (Authenticated):
Operating System: Windows
For affected 12.x version
The QID checks the "Oracle_Home" path with help of the registry key "HKLM\Software\Oracle". The QID verifies if the affected WebLogic version is installed on the host and then checks if the corresponding patch is applied or not.

For 10.3.6.0
The QID checks if WebLogic v10.3.6.0 is installed by looking at the file WLS_HOME\wlserver_10.3\.product.properties. The QID then checks if the corresponding patch is applied or not. The WLS_HOME is check using the file "systemdrive"\bea\beahomelist.

Patch IDs checked:
WebLogic Server 14.1.1.0 - Patch 32697788
WebLogic Server 12.2.1.4 - Patch 32698246
WebLogic Server 12.2.1.3 - Patch 32697734
WebLogic Server 12.1.3.0 - Patch 32345262
WebLogic Server 10.3.6.0 - Patch 32403651

QID Detection Logic (Unauthenticated) :
The qid sends a "GET console/login/LoginForm.jsp" request to retrieve the WebLogic version installed.

Successful exploitation could allow an attacker to affect the confidentiality, integrity and availability of data on the target system.