CVE-2019-2725

Опубликовано: 26 апр. 2019

Источник: nvd

CVSS3: 7.5

CVSS3: 9.8

CVSS2: 7.5

EPSS Критический

Описание

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Ссылки

http://packetstormsecurity.com/files/152756/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html
Third Party Advisory
VDB Entry
http://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html
Patch
Vendor Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
Patch
Vendor Advisory
http://www.securityfocus.com/bid/108074
Broken Link
https://support.f5.com/csp/article/K90059138
Third Party Advisory
https://www.exploit-db.com/exploits/46780/
Exploit
Third Party Advisory
VDB Entry
https://www.oracle.com/security-alerts/alert-cve-2019-2725.html#AppendixFMW
Patch
Vendor Advisory
https://www.oracle.com/security-alerts/cpujan2020.html
Patch
Vendor Advisory
http://packetstormsecurity.com/files/152756/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html
Third Party Advisory
VDB Entry
http://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html
Patch
Vendor Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
Patch
Vendor Advisory
http://www.securityfocus.com/bid/108074
Broken Link
https://support.f5.com/csp/article/K90059138
Third Party Advisory
https://www.exploit-db.com/exploits/46780/
Exploit
Third Party Advisory
VDB Entry
https://www.oracle.com/security-alerts/alert-cve-2019-2725.html#AppendixFMW
Patch
Vendor Advisory
https://www.oracle.com/security-alerts/cpujan2020.html
Patch
Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-2725
US Government Resource

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:oracle:agile_plm:9.3.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:agile_plm:9.3.4:*:*:*:*:*:*:*

cpe:2.3:a:oracle:agile_plm:9.3.5:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_converged_application_server:5.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_converged_application_server:7.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_converged_application_server:7.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*

cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*

cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*

cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool:2.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:tape_library_acsls:8.5:*:*:*:*:*:*:*

cpe:2.3:a:oracle:tape_virtual_storage_manager_gui:6.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*

Версия до 5.2.36 (исключая)

cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*

Версия от 6.0.0 (включая) до 6.0.16 (исключая)

cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*

Версия от 6.1.0 (включая) до 6.1.2 (исключая)

cpe:2.3:a:oracle:vm_virtualbox:5.2.36:*:*:*:*:*:*:*

cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*

EPSS

Процентиль: 100%

0.9447

Критический

7.5 High

CVSS3

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-74

Связанные уязвимости

GHSA-m437-3crh-7475

CVSS3: 9.8

github

больше 3 лет назад

BDU:2019-01748

CVSS3: 9.8

fstec

почти 7 лет назад

Уязвимость компонентов WLS9_ASYNC и WLS-WSAT сервера приложений Oracle WebLogic Server, позволяющая нарушителю выполнить произвольный код и перехватить контроль над целевой системой

EPSS

Процентиль: 100%

0.9447

Критический

7.5 High

CVSS3

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-74