CVE-2017-10137

CRITICAL

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: JNDI). Supported versions that are affected are 10.3.6.0 and 12.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

Published: Aug 8, 2017 Modified: Jun 17, 2026

NVD-CWE-noinfo

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: CHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected Products (2)

Vendor	Product	Version
oracle	weblogic_server	10.3.6.0.0
oracle	weblogic_server	12.1.3.0.0

GitHub Security Advisory GHSA-j6g4-w2h4-mv5j

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent:...

References (6)

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html Patch, Vendor Advisory
http://www.securityfocus.com/bid/99634 Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038939 Third Party Advisory, VDB Entry
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html Patch, Vendor Advisory
http://www.securityfocus.com/bid/99634 Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038939 Third Party Advisory, VDB Entry

Risk Scores

CVSS Score 10.0 / 10

EPSS Score 3.79%

Top 11% most likely to be exploited

Threat Score 41.1 / 100

Data Sources

NVD EPSS GitHub