NVD

Id
26173  
Name
CVE-2015-4852  
Description
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-07-18  
Published
2015-11-18  
Modified Date
2017-07-10  
Seq
2015-4852  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
138457 26173 CVE-2015-4852 http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/  View
138458 26173 CVE-2015-4852 [oss-security] 20151117 Re: Assign CVE for common-collections remote code execution on deserialisation flaw  View
138459 26173 CVE-2015-4852 http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html  View
138460 26173 CVE-2015-4852 http://www.oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.html  View
138461 26173 CVE-2015-4852 http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html  View
138462 26173 CVE-2015-4852 77539  View
138463 26173 CVE-2015-4852 https://blogs.oracle.com/security/entry/security_alert_cve_2015_4852  View
138464 26173 CVE-2015-4852 https://github.com/foxglovesec/JavaUnserializeExploits/blob/master/weblogic.py  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
10648 JVNDB-2015-005968 Oracle WebLogic Server の WLS Security コンポーネントにおける任意のコマンドを実行される脆弱性 Oracle WebLogic Server の WLS Security コンポーネントには、oracle_common/modules/com.bea.core.apache.commons.collections.jar に関する処理に不備があるため、任意のコマンドを実行される脆弱性が存在します。 CVE-2015-4852 82077 CVE-2015-4852 26173 7.5 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-005968.html 2015-11-10 2015-11-20 View