CVE-2019-2729

PoC —

CVSS 3.1

9.8 critical

EPSS

89%p100

Published

Jun 19, 2019 (Jun 19, 2019)

Modified

Jun 17, 2026

Description

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Vendors: oracle
Products: communications diameter signaling router, communications network integrity, hyperion infrastructure technology, identity manager, peoplesoft enterprise peopletools, rapid planning, storagetek tape analytics sw tool, tape library acsls, weblogic server
Weakness: CWE-284
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (88.8%)

CVE-2019-2729

In the news9 stories

Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report

Oracle fixes critical RCE vulnerabilities in Weblogic Server

Oracle Warns of Critical Remotely Exploitable Weblogic Server Flaws

Hackers are targeting recently patched WebLogic security vulnerability

IT threat evolution Q3 2019

Week in review: Kali Linux roadmap, runtime container security, new issue of (IN)SECURE

New Critical Oracle WebLogic Flaw Under Active Attack — Patch Now

Another Remote Code Execution Flaw in WebLogic exploited in the wild

Another Oracle WebLogic Server RCE under active exploitation