Cyber Resilience

CVE-2018-3191

Oracle Weblogic Server 10.3.6.0.0 … 12.2.1.3.0

High EPSS
Published
17 October 2018
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3 9.8
Click a component to see what it means
Raw vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.63 99.1th percentile
Risk Priority 97 floored blend · peak EPSS

Summary

CVE-2018-3191 is a critical-severity an unspecified weakness vulnerability in Oracle Weblogic Server. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 0.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic…

more

Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CWE(s)
NVD-CWE-noinfo

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
Unauthenticated network exploit via T3 protocol leads to full server compromise.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalationconfidence: HIGH
Remote code execution vulnerability allows privilege escalation to full server control.
attack.mitre.org →
inferred from description · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2023-22072Same product: Oracle Weblogic Server
CVE-2021-2394Same product: Oracle Weblogic Server
CVE-2024-20927Same product: Oracle Weblogic Server
CVE-2026-35298Same product: Oracle Weblogic Server
CVE-2026-60202Same product: Oracle Weblogic Server
CVE-2026-60203Same product: Oracle Weblogic Server
CVE-2017-10271Same product: Oracle Weblogic Server
CVE-2024-21216Same product: Oracle Weblogic Server
CVE-2026-60196Same product: Oracle Weblogic Server
CVE-2020-14841Same product: Oracle Weblogic Server

Affected Assets

oracle
weblogic server
10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References