SID 1:50660

Report a false positive

Rule Category

POLICY-OTHER --

Alert Message

POLICY-OTHER Oracle WebLogic Server blacklisted class use attempt

Rule Explanation

This event is generated when an attacker attempts to exploit a remote code execution vulnerability in Oracle WebLogic. Impact: Attempted User Privilege Gain Details: This rule checks for attempts to exploit a remote code execution vulnerability in Oracle WebLogic. Ease of Attack:

What To Look For

No information provided

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group

Rule Groups

No rule groups

CVE

CVE-2017-10271 CVE-2017-3506 CVE-2019-2725 CVE-2019-2729

Additional Links

www.oracle.com/technetwork/security-advisory/alert-cve-2019-2729-5570780.html
www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html
www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Rule Vulnerability

CVE Additional Information

This product uses data from the NVD API but is not endorsed or certified by the NVD.
CVE-2017-10271
 Loading description
CVE-2017-3506
 Loading description
CVE-2019-2725
 Loading description
CVE-2019-2729
 Loading description