VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 19 hours ago

CVE-2017-3506

7.4 High Protected by RASP

Description

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data as well as unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

CWE-78 · OS command injection

Exploitation Status

Exploited in the wild

Confirmed real-world exploitation.

CVSS E:A

  • CISA KEV listed Confirmed exploitation in the wild. Added 2024-06-03 · remediation due 2024-06-24 · ransomware use: unknown
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: no, technical impact: total.
  • Indexed PoC 3 indexed Published artifacts you can open, in GitHub PoC, Nuclei; first seen 2019-11-05.
  • EPSS 96% chance in 30 days A model prediction, not an observation. Higher than 100% of all scored CVEs.

1 of these are GitHub repositories below the 5★ evidence bar. They are listed because a person may still want to open one; they do not count toward the exploit maturity above.

IndexArtifactStarsFirst seen
GitHub PoC CVE-2017-3506 10 2020-11-18
GitHub PoC CVE-2017-3506 3 2019-11-05
Nuclei Oracle Fusion Middleware Weblogic Server - Remote OS Command Execution

Waratek Defense Posture

Protected by RASP

A Waratek agent blocks this today.

Applicable rule: A researcher classified this CVE as MITIGATED-BY-SECURE-RULE.

  • Protection full a general security rule for the vulnerability class
  • Action available security rule
  • Review human manual-review
  • Record active
Decided by manual-classification : A researcher's recorded decision for this specific CVE
Finding A researcher classified this CVE as MITIGATED-BY-SECURE-RULE.

Waratek research note

written 2026-09-14

Written by a Waratek engineer reviewing this CVE. A written classification sets the status directly, ahead of every automated scope rule except a withdrawal.

Looks like a process forking: https://hackerone.com/reports/810778

H2 Historical Data

Labels: HTTP, WEB SERVICES, NO AUTH REMOTE EXPLOIT

Products: ORACLE WEBLOGIC SERVER, ORACLE FUSION MIDDLEWARE

CVSS

7.4 HIGH v3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N 3 metrics

VRT selects the newest version's highest entry and publishes it as cvssScore, newest rather than largest because scores are not comparable across versions, and highest rather than first because the first entry is frequently a CNA placeholder scoring 0.0 over NVD's own analysis.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.4 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N NVD Primary published
CVSS 3.1 7.4 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CISA-ADP Secondary
CVSS 2.0 5.8 no band published AV:N/AC:M/Au:N/C:P/I:P/A:N NVD Primary

Affected Software & Releases

🏛️ Oracle CPU Advisories & Products

AdvisoryTypeQuarterProducts Oracle named in risk matrix
Oracle Critical Patch Update April 2017 ↗ CPU 2017-Q2 Oracle Fusion Middleware / Web Services (10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1, 12.2.1.2)

Indexed Oracle Components & Versions

FamilyComponentOracle's version cell (verbatim)Indexed as
Oracle Fusion Middleware Web Services 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1, 12.2.1.2 10.3.6.0 · 12.1.3.0 · 12.2.1.0 · 12.2.1.1 · 12.2.1.2

🖥️ Product CPEs & Version Ranges

1 product(s) over 5 version claims (uncapped)
SourceVendorProductSchemeAffected Versions
nvd oracle weblogic server generic 10.3.6.0.0 · 12.1.3.0.0 · 12.2.1.0.0 · 12.2.1.1.0 · 12.2.1.2.0

Manual classification context

A reviewer manually classified this CVE. The retained record includes the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** HTTP, WEB SERVICES, NO AUTH REMOTE EXPLOIT **Products:** ORACLE WEBLOGIC SERVER, ORACLE FUSION MIDDLEWARE

References

URLTags
https://www.oracle.com/security-alerts/cpuapr2017.html
http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html Patch, Vendor Advisory
http://www.securityfocus.com/bid/97884 Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038296 Broken Link, Third Party Advisory, VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-3506 US Government Resource

Timeline

Published 2017-04-24 Last modified 2026-06-17
Published2017-04-24By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.
Classification created2026-09-14First commit adding this CVE's research note.
Last VRT activity2026-09-14Most recent commit touching this CVE's classification, patch or rule file.