Weblogic 12C Vulnerability Issue : Java JMX RMI Accessible with Common Credentials (Unauthenticated

Manmohan Bhakuni

Good Evening Experts,

Hope you are doing good.

I got a vulnerability in my production server and needs to be resolved at the earliest please:

Server OS : Windows 2012r2

Weblogic Server: 12c R1

The vulnerability is :

"Java JMX RMI Accessible with Common Credentials (Unauthenticated check)"

Java JMX interface is accessible via following username/password pairs:

admin/password 

admin/admin 

admin/activemq 

monitorRole/QED 

controlRole/R%26D

controlrole/password 

monitorrole/password 

cassandra/cassandrapassword 

monitorRole/tomcat 

controlRole/tomcat 

monitorRole/mrpasswd 

controlRole/crpasswd 

role1/role1passwd 

ole2/role2passwd 

role3/role3passwd 

admin/thisIsSupposedToBeAStrongPassword! 

QID Detection Logic (Authenticated):  

This QID tries to log into JMX RMI server using above credentials.

Note:if remote JMX RMI sever accessible without authentication. all of above credentials will post.

Sincerely,

Manmohan Bhakuni

Manmohan Bhakuni

Dear Experts,

Any suggestion would be highly appreciated please.

Sincerely

Manmohan