CVE-2018-2628

CRITICAL CISA KEV

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Published: Apr 19, 2018 Modified: Jun 17, 2026

CWE-502 CWE-502

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (4)

Vendor	Product	Version
oracle	weblogic_server	10.3.6.0.0
oracle	weblogic_server	12.1.3.0.0
oracle	weblogic_server	12.2.1.2.0
oracle	weblogic_server	12.2.1.3

GitHub Security Advisory GHSA-882j-m7wv-38p6

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent:...

References (15)

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html Patch, Vendor Advisory
http://www.securityfocus.com/bid/103776 Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040696 Broken Link, Third Party Advisory, VDB Entry
https://github.com/brianwrf/CVE-2018-2628 Broken Link
https://www.exploit-db.com/exploits/44553/ Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/45193/ Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/46513/ Exploit, Third Party Advisory, VDB Entry
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html Patch, Vendor Advisory
http://www.securityfocus.com/bid/103776 Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040696 Broken Link, Third Party Advisory, VDB Entry
https://github.com/brianwrf/CVE-2018-2628 Broken Link
https://www.exploit-db.com/exploits/44553/ Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/45193/ Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/46513/ Exploit, Third Party Advisory, VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2628 US Government Resource

Risk Scores

CVSS Score 9.8 / 10

EPSS Score 99.45%

Top 0% most likely to be exploited

Threat Score 99 / 100

CISA Known Exploited

Date Added: 2022-09-08

Due Date: 2022-09-29

Required Action:

Apply updates per vendor instructions.

Data Sources

NVD CISA KEV EPSS GitHub