QID 87458

Oracle WebLogic Server (formerly known as BEA WebLogic Server) is an application server for building and deploying enterprise applications and services.
The Oracle WebLogic Server component in Oracle Fusion Middleware for versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0 has fixes for multiple vulnerabilities.

Affected Versions:
Oracle WebLogic Server, version(s) 10.3.6.0, 12.1.3.0, 12.2.1.3,12.2.1.4 and 14.1.1.0

QID Detection Logic (Authenticated):
Operating System: Linux
This QID checks to see if Oracle WebLogic Server process is listening on any of the TCP ports. If so, for version 12.x it gets the "Oracle_Home" path, navigates to that directory and reads "registry.xml" and the patch files found in the directory "Oracle_Home"\inventory\patches to check if the installed version is patched.
For version 10.3.6.x, it gets the "Oracle_Home" path, navigates to that directory and reads "registry.xml" and the file "Oracle_Home"\patch_wls1036\registry\patch-registry.xml to check if the installed version is patched.

QID Detection Logic (Authenticated):
Operating System: Windows
For affected 12.x version
The QID checks the "Oracle_Home" path with help of the registry key "HKLM\Software\Oracle". The QID verifies if the affected WebLogic version is installed on the host and then checks if the corresponding patch is applied or not.

For 10.3.6.0
The QID checks if WebLogic v10.3.6.0 is installed by looking at the file WLS_HOME\wlserver_10.3\.product.properties. The QID then checks if the corresponding patch is applied or not. The WLS_HOME is check using the file "systemdrive"\bea\beahomelist.

Patch IDs checked:
WebLogic Server 14.1.1.0 - Patch 33069656
WebLogic Server 12.2.1.4 - Patch 33059296
WebLogic Server 12.2.1.3 - Patch 33064699
WebLogic Server 12.1.3.0 - Patch 32832660
WebLogic Server 10.3.6.0 - Patch 32832785

QID Detection Logic (Unauthenticated) :
The qid sends a "GET console/login/LoginForm.jsp" request to retrieve the WebLogic version installed.

Successful exploitation could allow an attacker to affect the confidentiality, integrity and availability of data on the target system.