CVE-2020-2555

critical

Description

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

References

https://www.tenable.com/cyber-exposure/2020-threat-landscape-retrospective

https://media.defense.gov/2020/Oct/20/2002519884/-1/-1/0/CSA_CHINESE_EXPLOIT_VULNERABILITIES_UOO179811.PDF

https://peterjson.medium.com/miracle-one-vulnerability-to-rule-them-all-c3aed9edeea2

https://www.tenable.com/blog/oracle-january-2021-critical-patch-update-five-critical-weblogic-flaws-cve-2021-2109

https://www.tenable.com/blog/cve-2020-14882-oracle-weblogic-remote-code-execution-vulnerability-exploited-in-the-wild

https://www.tenable.com/blog/government-agencies-warn-of-state-sponsored-actors-exploiting-publicly-known-vulnerabilities

https://www.tenable.com/blog/oracle-critical-patch-update-for-october-2020-addresses-402-security-updates

https://www.tenable.com/blog/oracle-january-2020-critical-patch-update-contains-255-cves

https://github.com/psibot/oracle-weblogic-vulnerable

https://github.com/kuckibf/Popular-CVEs

https://github.com/minhangxiaohui/Weblogic_Coherence_try

https://github.com/adm1in/CodeTest

https://github.com/zzwlpx/weblogicPoc

https://github.com/zhzyker/exphub

https://github.com/5l1v3r1/CVE-2020-2556

https://github.com/Maskhe/cve-2020-2555

https://github.com/hktalent/CVE_2020_2546

https://github.com/0xn0ne/weblogicScanner

https://www.oracle.com/security-alerts/cpuoct2020.html

https://www.oracle.com/security-alerts/cpujul2021.html

https://www.oracle.com/security-alerts/cpujul2020.html

https://www.oracle.com/security-alerts/cpujan2021.html

https://www.oracle.com/security-alerts/cpujan2020.html

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-2555

http://packetstormsecurity.com/files/157795/WebLogic-Server-Deserialization-Remote-Code-Execution.html

http://packetstormsecurity.com/files/157207/Oracle-WebLogic-Server-12.2.1.4.0-Remote-Code-Execution.html

http://packetstormsecurity.com/files/157054/Oracle-Coherence-Fusion-Middleware-Remote-Code-Execution.html

Details

Source: Mitre, NVD

Published: 2020-01-15

Updated: 2026-06-17

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.97116