Following initial reports that attackers were exploiting a vulnerability in Oracle WebLogic Server, researchers have shared more information about the flaw and its connection to CVE-2020-2555, just as a proof-of-concept has become available.

CVE-2020-2883: Oracle WebLogic Deserialization Vulnerability Exploited in the Wild

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

The version of Oracle WebLogic Server installed on the remote host is affected by a remote code execution vulnerability in the WLS Core Components subcomponent due to unsafe deserialization of Java objects. An unauthenticated remote attacker can exploit this, via a crafted serialized Java object, to execute arbitrary commands.

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the CPUApr2020 advisory.

  - A remote code execution vulnerability exists in the Log4j SocketServer class due to unsafe deserialization of     untrusted data. An unauthenticated, remote attacker can exploit this to remotely execute arbitrary code when     combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j     versions up to 1.2 up to 1.2.17. (CVE-2019-17571)

  - An information disclosure vulnerability exists in the Console component. An unauthenticated, remote attacker can     exploit this to gain unauthorized read access to a subset of Oracle WebLogic Server accessible data. (CVE-2020-2766)

  - A vulnerability in the WLS Web Services component exists. An authenticated, remote attacker can exploit this via T3     to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle     WebLogic Server. (CVE-2020-2798)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
138074	Oracle WebLogic Server Java Object Deserialization RCE (CVE-2020-2883)	Nessus	Web Servers	critical
701276	Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0 T3 Access Attack	Nessus Network Monitor	Generic	critical
135680	Oracle WebLogic Server Multiple Vulnerabilities (Apr 2020 CPU)	Nessus	Misc.	critical

Detections

Analytics

CVE-2020-2883

critical

Tenable Plugins

critical

critical

critical