Detections
Analytics
CVE-2019-2729
critical
Description
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
From the Tenable Blog
CVE-2019-2729: Oracle Releases Out-of-Band Patch for WebLogic Server Deserialization Vulnerability
Published: 2019-06-19
Out-of-band security advisory addresses second Oracle WebLogic Server vulnerability in two months. Background On June 18, Oracle published an out-of-band security advisory to address a critical vulnerability in Oracle WebLogic Server.
References
https://www.oracle.com/security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.tenable.com/blog/oracle-january-2020-critical-patch-update-contains-255-cves
https://www.tenable.com/blog/oracle-critical-patch-update-for-july-contains-265-fixes
https://github.com/psibot/oracle-weblogic-vulnerable
https://github.com/pizza-power/weblogic-CVE-2019-2729-POC
https://github.com/ruthlezs/CVE-2019-2729-Exploit
https://github.com/0xn0ne/weblogicScanner
https://github.com/waffl3ss/CVE-2019-2729
https://github.com/black-mirror/Weblogic
https://github.com/dr0op/WeblogicScan
http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
http://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2729-5570780.html
http://packetstormsecurity.com/files/155886/Oracle-Weblogic-10.3.6.0.0-Remote-Command-Execution.html