Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2017-3506 Details

Description

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data as well as unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:7.4 HIGHVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA: CISA-ADPCVSS-B:7.4 HIGHVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-3506 CISA-ADPUS Government Resource
http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html CVEPatchVendor Advisory
http://www.securityfocus.com/bid/97884 CVEBroken LinkThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1038296 CVEBroken LinkThird Party AdvisoryVDB Entry
http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html [email protected]PatchVendor Advisory

see all 7 references

This CVE is in CISA's Known Exploited Vulnerabilities Catalog

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.

Vulnerability NameDate AddedDue DateRequired Action
Oracle WebLogic Server OS Command Injection VulnerabilityJun 3, 2024Jun 24, 2024Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Weakness Enumeration

CWE-IDCWE NameSource
NVD-CWE-noinfoInsufficient Information to Classify Weakness[email protected]
CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CISA-ADP

Affected Products

ProductVersions
oracle weblogic server
10.3.6.0.0
12.1.3.0.0
12.2.1.0.0
12.2.1.1.0
12.2.1.2.0

CPE

  • cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:weblogic_server:12.2.1.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:weblogic_server:12.2.1.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:weblogic_server:12.2.1.2.0:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

22 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2017-3506
NVD Published Date:
Apr 24, 2017
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2017-3506 Details - Not Deferred