Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2017-3531

19
FAUCET Score

CVE-2017-3531 is an easily exploitable vulnerability in the Servlet Runtime subcomponent of Oracle WebLogic Server versions 12.1.3.0 through 12.2.1.2. An unauthenticated attacker with network access via HTTP can compromise the server. This vulnerability has a CVSS 3.0 Base Score of 7.2 (High), indicating that successful attacks can lead to unauthorized data modification (insert, update, delete) and a partial denial of service. While no public exploit code (Metasploit, Nuclei, ExploitDB) is available and it's not listed in CISA's KEV catalog, its low EPSS score suggests a low probability of active exploitation. Community discussion and media coverage are also minimal.

Impacted Technologies

VendorProductVersion(s)CPE
12.1.3.0.0CPE matchmatch criteria
cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*
12.2.1.0.0CPE matchmatch criteria
cpe:2.3:a:oracle:weblogic_server:12.2.1.0.0:*:*:*:*:*:*:*
12.2.1.1.0CPE matchmatch criteria
cpe:2.3:a:oracle:weblogic_server:12.2.1.1.0:*:*:*:*:*:*:*
12.2.1.2.0CPE matchmatch criteria
cpe:2.3:a:oracle:weblogic_server:12.2.1.2.0:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.0

7.2HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
LOW
Exploitability Score
3.9
Impact Score
2.7
CvssVersion
3.0

Exploit Intelligence

EPSS Score
1.93%
Probability of exploitation in next 30 days
EPSS Percentile
77.8%
Percentile rank of EPSS score among Peer Group
As of 2026-07-26
Model: v2026.06.15
This CVE's current EPSS score of 0.0193 is in the 61st percentile among its peer group of 51,485 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (5)

oraclepatch availablevia nvd_reference
View patch
lexmarkvendor investigatingvia llm_extracted
libreofficevendor investigatingvia llm_extracted
mitelvendor investigatingvia llm_extracted
postgresqlvendor investigatingvia llm_extracted

Vendor Advisories (4)

mitelllm-mitel-25e365cdf6d7ae35CRITICAL

[R1] Oracle WebLogic Server Web Container Subcomponent Reflected PartItem File Manipulation Remote Code Execution

Apr 18, 2017
postgresqlllm-postgresql-55a4a1c0f1bacff7CRITICAL

[R1] Oracle WebLogic Server Web Container Subcomponent Reflected PartItem File Manipulation Remote Code Execution

Apr 18, 2017
lexmarkllm-lexmark-0123653d2e67a914CRITICAL

[R1] Oracle WebLogic Server Web Container Subcomponent Reflected PartItem File Manipulation Remote Code Execution

Apr 18, 2017
libreofficellm-libreoffice-01680f2a60df2a51CRITICAL

[R1] Oracle WebLogic Server Web Container Subcomponent Reflected PartItem File Manipulation Remote Code Execution

Apr 18, 2017

References

tenable.com / security/research/tra-2017-16
oracle.com / technetwork/security-advisory/cpuapr2017-3236618.html
PatchVendor Advisory
securityfocus.com / bid/97894
Third Party AdvisoryVDB Entry
securitytracker.com / id/1038296