PT-2007-1146 · Oracle+1 · Oracle Weblogic Server+2

Ck01 + 1 · Publicado 2007-04-10 · Atualizado 2025-10-27 · CVE-2019-2725

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Oracle WebLogic Server versions 10.3.6.0.0 and 12.1.3.0.0

Description: The issue is related to the Oracle WebLogic Server component of Oracle Fusion Middleware, specifically the Web Services subcomponent. It is an easily exploitable vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise the Oracle WebLogic Server. Successful attacks can result in the takeover of the Oracle WebLogic Server. The vulnerability is associated with flaws in the deserialization mechanism of the WLS9 ASYNC and WLS-WSAT components, which can be exploited by sending a specially crafted HTTP request.

Recommendations: For Oracle WebLogic Server version 10.3.6.0.0, update to a version that includes the official fix. For Oracle WebLogic Server version 12.1.3.0.0, update to a version that includes the official fix. As a temporary workaround, consider restricting access to the Web Services subcomponent until a patch is available.

Exploit

Correção

Deserialization of Untrusted Data

Special Elements Injection

Enumeração de Fraquezas

CWE-502

CWE-74

Identificadores relacionados

ALSA-2025_16880

ALT-PU-2020-1123

ALT-PU-2020-1124

ALT-PU-2020-1125

ALT-PU-2020-1126

ALT-PU-2020-1127

ALT-PU-2020-1436

ALT-PU-2020-1437

ALT-PU-2020-1438

ALT-PU-2020-1439

ALT-PU-2020-1440

BDU:2019-01748

CVE-2019-2725

ORACLEWEBLOGICCVE_2019_2725

Produtos afetados

Alt Linux

Oracle Weblogic Server

Virtualbox

Referências · 46

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/weblogic_deserialize_asyncresponseservice.rb · Exploit
• 🔥 https://github.com/shack2/javaserializetools · Exploit
• 🔥 https://github.com/lufeirider/CVE-2019-2725 · Exploit
• 🔥 https://github.com/TopScrew/CVE-2019-2725 · Exploit
• 🔥 https://github.com/SkyBlueEternal/CNVD-C-2019-48814-CNNVD-201904-961 · Exploit
• 🔥 https://github.com/black-mirror/Weblogic · Exploit
• 🔥 https://github.com/jiansiting/CVE-2019-2725 · Exploit
• 🔥 https://github.com/pimps/CVE-2019-2725 · Exploit
• 🔥 https://github.com/buffered4ever/Exploits · Exploit
• 🔥 https://github.com/lasensio/cve-2019-2725 · Exploit
• 🔥 https://github.com/iceMatcha/CNTA-2019-0014xCVE-2019-2725 · Exploit
• 🔥 https://github.com/tobechenghuai/CNTA-2019-0014xCVE-2019-2725 · Exploit
• 🔥 https://github.com/kerlingcode/CVE-2019-2725 · Exploit
• 🔥 https://github.com/zhusx110/cve-2019-2725 · Exploit
• 🔥 https://github.com/ianxtianxt/CVE-2019-2725 · Exploit