VRT 391,810 CVEs tracked · 15,472 in RASP scope · data as of 55 minutes ago

CVE-2017-3248

9.8 Critical Protected by RASP

Description

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0 and 12.2.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS v3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).

Exploitation Status

Working exploit published

A reviewed exploit catalogue carries this CVE. Somebody has published code a stranger can run.

CVSS E:P

  • CISA KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC 3 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC; first seen 2018-07-07.
  • EPSS 97% chance in 30 days A model prediction, not an observation. Higher than 100% of all scored CVEs.

1 of these are GitHub repositories below the 5★ evidence bar. They are listed because a person may still want to open one; they do not count toward the exploit maturity above.

IndexArtifactStarsFirst seen
GitHub PoC weblogic 漏洞扫描工具。目前包含对以下漏洞的检测能力：CVE-2014-4210、CVE-2016-0638、CVE-2016-3510、CVE-2017-3248、CVE-2017-3506、CVE-2017-10271、CVE-2018-2628、CVE-2018-2893、CVE-2018-2894、CVE-2018-3191、CVE-2018-3245、CVE-2018-3252、CVE-2019-2618、CVE-2019-2725、CVE-2019-2729、CVE-2019-2890、CVE-2020-2551、CVE-2020-14750、CVE-2020-14882、CVE-2020-14883 2,075 2020-01-15
GitHub PoC CVE-2017-3248 2019-11-05
Exploit-DB Oracle WebLogic 12.1.2.0 - RMI Registry UnicastRef Object Java Deserialization Remote Code Execution 2018-07-07

Waratek Defense Posture

Protected by RASP

A Waratek agent blocks this today.

Applicable rule: A researcher classified this CVE as MITIGATED-BY-SECURE-RULE, protected by the ARMR Deserial sys rule, Marshal RCE rule.

  • Protection full a general security rule for the vulnerability class
  • Action available security rule
  • Review human manual-review
  • Record active
Decided by manual-classification : A researcher's recorded decision for this specific CVE
Finding A researcher classified this CVE as MITIGATED-BY-SECURE-RULE, protected by the ARMR Deserial sys rule, Marshal RCE rule.

Waratek research note

written 2026-09-14

Written by a Waratek engineer reviewing this CVE. A written classification sets the status directly, ahead of every automated scope rule except a withdrawal.

Comments

Rule Name: Deserial sys rule, Marshal RCE rule

CVSS

9.8 CRITICAL v3.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 2 metrics

VRT selects the newest version's highest entry and publishes it as cvssScore, newest rather than largest because scores are not comparable across versions, and highest rather than first because the first entry is frequently a CNA placeholder scoring 0.0 over NVD's own analysis.

VersionScoreBandVectorAssignerType
CVSS 3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 2.0 7.5 no band published AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected Software & Releases

🏛️ Oracle CPU Advisories & Products

AdvisoryTypeQuarterProducts Oracle named in risk matrix
Oracle Critical Patch Update January 2017 ↗ CPU 2017-Q1 Oracle Fusion Middleware / Oracle WebLogic Server (10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1)

Indexed Oracle Components & Versions

FamilyComponentOracle's version cell (verbatim)Indexed as
Oracle Fusion Middleware Oracle WebLogic Server 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 10.3.6.0 · 12.1.3.0 · 12.2.1.0 · 12.2.1.1

🖥️ Product CPEs & Version Ranges

1 product(s) over 4 version claims (uncapped)
SourceVendorProductSchemeAffected Versions
nvd oracle weblogic server generic 10.3.6.0.0 · 12.1.3.0.0 · 12.2.1.0.0 · 12.2.1.1.0

Manual classification context

A reviewer manually classified this CVE. The retained record includes the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** CORE COMPONENTS, T3, NO AUTH REMOTE EXPLOIT **Products:** ORACLE WEBLOGIC SERVER, ORACLE FUSION MIDDLEWARE

References

URLTags
http://packetstormsecurity.com/files/152357/Oracle-Weblogic-Server-Deserialization-RMI-UnicastRef-Remote-Code-Execution.html
http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html Patch, Vendor Advisory
http://www.securityfocus.com/bid/95465 Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037632
https://www.exploit-db.com/exploits/44998/
https://www.tenable.com/security/research/tra-2017-07
https://www.vicarius.io/vsociety/posts/cve-2017-3248-detect-centos-weblogic-rce
https://www.vicarius.io/vsociety/posts/cve-2017-3248-mitigate-centos-weblogic-rce

Timeline

Published 2017-01-27 Last modified 2026-06-17
Published2017-01-27By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.
Classification created2026-09-14First commit adding this CVE's research note.
Last VRT activity2026-09-14Most recent commit touching this CVE's classification, patch or rule file.