Actively exploited · Published Nov 18, 2015 · Assigned by oracle
CVE-2015-4852
Critical 9.8 Exploited
In plain English
A critical-severity unsafe deserialization in WebLogic Server from Oracle. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 95.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by May 3, 2022.
Official description
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | openjdk-8 | no fix listed | UBUNTU-CVE-2015-4852 |
| Ubuntu:24.04:LTS | openjdk-8 | no fix listed | UBUNTU-CVE-2015-4852 |
Affected products (as reported)
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html x_refsource_CONFIRM
- http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html x_refsource_CONFIRM
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html x_refsource_CONFIRM
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html x_refsource_CONFIRM
- https://github.com/foxglovesec/JavaUnserializeExploits/blob/master/weblogic.py x_refsource_MISC
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html x_refsource_CONFIRM
- https://blogs.oracle.com/security/entry/security_alert_cve_2015_4852 x_refsource_CONFIRM
- 1038292 vdb-entry, x_refsource_SECTRACK
- 77539 vdb-entry, x_refsource_BID
- http://www.oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.html x_refsource_CONFIRM
- [oss-security] 20151117 Re: Assign CVE for common-collections remote code execution on deserialisation flaw mailing-list, x_refsource_MLIST
- 42806 exploit, x_refsource_EXPLOIT-DB
- http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/ x_refsource_MISC
- http://packetstormsecurity.com/files/152268/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html x_refsource_MISC
- 46628 exploit, x_refsource_EXPLOIT-DB
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-4852 government-resource