Vulnerabilitycritical
Oracle botches CVE-2018-2628 patch and hackers promptly start scanning for vulnerable WebLogic installs
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-2628 | Unauthenticated Java Deserialization RCE in Oracle WebLogic Server via T3 | 9.8 | 100% | KEVPoC ×3 | KEV |
From the original article
1 min read at securityaffairs.com
According to a security expert, Oracle appears to have botched the CVE-2018-2628 fix, this means that attackers could bypass it to take over WebLogic servers. Earlier April, Oracle patched the critical CVE-2018-2628 vulnerability in Oracle WebLogic server, but an Alibaba security researcher @pyn3rd discovered that the proposed fix could be bypassed.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.