Stefano Ciccone

Researcher fromAon's Cyber Labs

#19533of 60,399

15.9Total CVSS

Vulnerabilities · 2

Medium

1

Critical

1

Oracle Weblogic Server

The issue is related to insufficient access control in the WLS Core Components of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via the IIOP protocol to compromise the server. Successful attacks can result in the takeover of Oracle WebLogic Server.

Spring Web Flow

The issue concerns malicious EL expressions in view states that process form submissions. This can affect applications that do not change the value of the `useSpringBinding` property, which is disabled by default.