Oracle fixes critical RCE vulnerabilities in Weblogic Server
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-2729 | Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). NVD description · AI analysis pending | 9.8 | 89% | PoC |
| — | |
| CVE-2021-2394 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). NVD description · AI analysis pending | 9.8 group max | 77% |
| — |
Full article272 words · extracted from securityaffairs.com · click to collapse
Oracle released its Critical Patch Update for July 2021, it fixes hundreds of flaws, including Critical Remotely Exploitable vulnerabilities in Weblogic Server.
Oracle this week released its quarterly Critical Patch Update for July 2021 that contains 342 new security patches for multiple product families. Some of the vulnerabilities addressed by the IT giant could be remotely exploited by attackers to take control of devices.
One of the most severe issues addressed by Oracle is a critical deserialization vulnerability via XMLDecoder in Oracle WebLogic Server Web Services. The CVE-2019-2729 flaw is a remote code execution vulnerability that could be exploited by an unauthenticated attacker.
“This Security Alert addresses CVE-2019-2729, a deserialization vulnerability via XMLDecoder in Oracle WebLogic Server Web Services. This remote code execution vulnerability is remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password.” reads the advisory published by Oracle.
“Due to the severity of this vulnerability, Oracle strongly recommends that customers apply the updates provided by this Security Alert as soon as possible.”
The vulnerability received a CVSS score of 9.8 out of 10, it resides in the Oracle Hyperion Infrastructure Technology and affects WebLogic Server versions 11.1.2.4 and 11.2.5.0.
The company also addressed other vulnerabilities in WebLogic Server, three of which rated as critical severity:
- CVE-2021-2394 (CVSS score: 9.8)
- CVE-2021-2397 (CVSS score: 9.8)
- CVE-2021-2382 (CVSS score: 9.8)
- CVE-2021-2378 (CVSS score: 7.5)
- CVE-2021-2376 (CVSS score: 7.5)
- CVE-2021-2403 (CVSS score: 5.3)
Oracle urges customers to install security updates immediately.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Weblogic)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/120439/security/oracle-weblogic-server-flaws.html