CVE-2017-10271
Oracle Corporation WebLogic Server Remote Code Execution Vulnerability
CVSS
7.5
Alto
EPSS
100.0%
p100
KEV
SÍ
10 feb 2022
Exploit Today
80
0-100
Publicado: 19 oct 2017 · Última mod.: 13 ago 2026 · CWE-306
100.0%EPSS · 30 días100.0%
2026-09-162026-10-14
Producto
Oracle / WebLogic Server
Vulnerabilidad
Oracle Corporation WebLogic Server Remote Code Execution Vulnerability
Añadido a KEV
10 feb 2022
Remediar antes de
10 ago 2022
Uso conocido en ransomware
Sí
Descripción resumida
Oracle Corporation WebLogic Server contains a vulnerability that allows for remote code execution.
Acción requerida
Apply updates per vendor instructions.
Notas
https://nvd.nist.gov/vuln/detail/CVE-2017-10271
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
- www.oracle.comhttp://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- www.securityfocus.comhttp://www.securityfocus.com/bid/101304
- www.securitytracker.comhttp://www.securitytracker.com/id/1039608
- github.comhttps://github.com/c0mmand3rOpSec/CVE-2017-10271
- www.exploit-db.comhttps://www.exploit-db.com/exploits/43458/
- www.exploit-db.comhttps://www.exploit-db.com/exploits/43924/
- www.oracle.comhttp://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- www.securityfocus.comhttp://www.securityfocus.com/bid/101304
- www.securitytracker.comhttp://www.securitytracker.com/id/1039608
- github.comhttps://github.com/c0mmand3rOpSec/CVE-2017-10271
- www.exploit-db.comhttps://www.exploit-db.com/exploits/43458/
- www.exploit-db.comhttps://www.exploit-db.com/exploits/43924/
- www.cisa.govhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-10271
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1108387.5 ALT—
——0FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes into the host user's X11 session via XTEST.8hCVE-2026-718548.2 ALT—
——0OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Prior to version 2.260622.0, on a default installation, the `/api/player/**` lessons endpoints can be called without authentication, and they trust a client-supplied `userId` query parameter without verifying that the caller is that user or a member of the exercise. An unauthenticated client that knows an exercise UUID can read lessons-learned questions and answers (including each answer's author identity) and create or overwrite answers attributed to an arbitrary user. Version 2.260622.0 contains a patch.10hCVE-2026-648563.7 BAJ—
——0FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.20.0, FileRise /api/file/snippet.php does not apply the standard authenticated-session guard before processing short text preview requests. The endpoint still performs FileRise ACL checks, so normal installations do not expose an unauthenticated arbitrary file read, but unauthenticated requests can reach ACL evaluation instead of receiving an immediate 401 response. Only additional unusual proxy-header or ACL misconfiguration is documented as allowing requests to proceed into path and file-content handling. This issue is fixed in version 3.20.0.10hCVE-2026-574927.4 ALT—
——0FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise treats an empty or missing users.txt file as a fresh installation even after setup previously completed. If storage loss, truncation, or another failure empties the user store, an unauthenticated remote caller can detect that setup mode reopened and create the next initial administrator account through the setup flow. The application lacked a durable setup-complete marker independent of the mutable user store. This issue is fixed in version 3.16.0.10hCVE-2026-1041105.3 MED—
——0FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.24.0, FileRise Pro /api/pro/portals/get.php returns a configured client portal's full internal record to an unauthenticated caller who knows or guesses the portal slug. The response includes the internal storage folder path, client contact email, form settings, and upload-policy details, while the separate publicMeta.php endpoint intentionally exposes only curated branding data. Exploitation requires the Pro add-on and at least one configured portal. This issue is fixed in version 3.24.0.10hCVE-2026-1041066.5 MED—
——0FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise permits an authenticated session with a valid CSRF token to disable TOTP without recent full reauthentication or to begin enrollment when the account currently has no TOTP secret. The enrollment endpoint returns 409 rather than directly overwriting an already configured secret, but it persists and activates a newly generated secret before a TOTP code verifies possession. An attacker controlling an existing authenticated session can therefore disable an existing second factor or enroll one after the account has no configured secret; this is not a direct overwrite of an active authenticator. This issue is fixed in version 3.23.0.10h