CVE-2023-40571
Description
weblogic-framework is a tool for detecting weblogic vulnerabilities. Versions 0.2.3 and prior do not verify the returned data packets, and there is a deserialization vulnerability which may lead to remote code execution. When weblogic-framework gets the command echo, it directly deserializes the data returned by the server without verifying it. At the same time, the classloader loads a lot of deserialization calls. In this case, the malicious serialized data returned by the server will cause remote code execution. Version 0.2.4 contains a patch for this issue.
How to fix
- weblogic-framework_project weblogic-framework0.2.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| weblogic-framework_project weblogic-framework | v < 0.2.4 | 0.2.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.