Exploit for Improper Access Control in Oracle Communications Diameter Signaling Router CVE-2017-10271 CVE-2019-2729

githubexploit · 2021-05-31

Description

Cannot assist with exploits. Provides safe overview and remediation guidance only.

Entry point

Parametersoap envelope payload · request body

Path/wls-wsat/CoordinatorPortType

Deserialization-based RCE via WLS-WSAT endpoint (CVE-2017-10271) using crafted SOAP payload

Affected software

Oracle Weblogic Server= 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0, 12.2.1.2.0, 12.2.1.3.0

Oracle Communications Diameter Signaling Router= 8.0, 8.1, 8.2, 8.2.1

Oracle Communications Network Integrity≤ 7.3.6

Oracle Hyperion Infrastructure Technology= 11.1.2.4, 11.2.5.0

All known vulnerabilities by product

Oracle Weblogic Server

CVSS Score

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:NONE

Integrity:NONE

Availability:HIGH

Working code

100%confidence this exploit runs

Based on 2 file(s) in the source

EPSS Score

100.0%higher than 100.0% of all CVEs

Updated 2026-06-24

Exploit Details

Modified:2022-08-27 19:09

Last Seen:2025-09-06 06:03

Reporter:pizza-power

Tags

vulnerabilitymitigationoraclepatchingaccess controlweblogic

Other exploits for the same CVE

Exploit for Missing Authentication for Critical Function in Oracle Weblogic_Server

2026-05-27 DungsocoolGITHUB

📄 Oracle WebLogic WLS-WSAT XMLDecoder Remote Code Execution

2026-05-11 indoushkaPACKETSTORM

Exploit for Missing Authentication for Critical Function in Oracle Weblogic_Server

2025-10-15 seoyoung-kangGITHUB

Exploit for Missing Authentication for Critical Function in Oracle Weblogic_Server

2025-07-27 mirrors_jas502nGITEE

Exploit for Improper Input Validation in Joomla Joomla\!

2025-07-27 mirrors_SecWikiGITEE

Exploit for Missing Authentication for Critical Function in Oracle Weblogic_Server

2025-07-06 mirrors_kingkakiGITEE

Exploit for Improper Access Control in Oracle Communications_Diameter_Signaling_Router

2022-09-22 LuchoaneGITHUB

Exploit for Missing Authentication for Critical Function in Oracle Weblogic_Server

2021-05-24 dlcfGITEE

Exploit Code

README3 lines

## https://sploitus.com/exploit?id=921C47CA-3B88-513A-9889-92A17813ED0A
# weblogic-CVE-2019-2729-POC
python3 POC for CVE-2019-2729 WebLogic Deserialization Vulnerability and CVE-2017-10271 amongst others