Veille CVE
CVE-2019-2725
9.8 Critique Exploitée activement Utilisée par des rançongicielsCatalogue CISA KEV — Oracle WebLogic Server, Injection
Ajoutée le 10/01/2022 · Échéance de correction (agences US) : 10/07/2022
Action requise : Apply updates per vendor instructions.
Description
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Produits concernés
- Oracle Corporation Tape Library ACSLS
- Oracle agile product lifecycle management
- Oracle communications converged application server
- Oracle peoplesoft enterprise peopletools
- Oracle storagetek tape analytics sw tool
- Oracle tape library acsls
- Oracle tape virtual storage manager gui
- Oracle vm virtualbox
- Oracle weblogic server
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 9.8 Critique | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.0 | 7.5 Élevée | secalert_us@oracle.com | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 2.0 | 7.5 Élevée | nvd@nist.gov (NVD) | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Faiblesses (CWE)
Références
- http://packetstormsecurity.com/files/152756/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html Third Party AdvisoryVDB Entry
- http://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html PatchVendor Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html PatchVendor Advisory
- http://www.securityfocus.com/bid/108074 Broken Link
- https://support.f5.com/csp/article/K90059138 Third Party Advisory
- https://www.exploit-db.com/exploits/46780/ ExploitThird Party AdvisoryVDB Entry
- https://www.oracle.com/security-alerts/alert-cve-2019-2725.html#AppendixFMW PatchVendor Advisory
- https://www.oracle.com/security-alerts/cpujan2020.html PatchVendor Advisory
- http://packetstormsecurity.com/files/152756/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html Third Party AdvisoryVDB Entry
- http://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html PatchVendor Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html PatchVendor Advisory
- http://www.securityfocus.com/bid/108074 Broken Link
- https://support.f5.com/csp/article/K90059138 Third Party Advisory
- https://www.exploit-db.com/exploits/46780/ ExploitThird Party AdvisoryVDB Entry
- https://www.oracle.com/security-alerts/alert-cve-2019-2725.html#AppendixFMW PatchVendor Advisory
- https://www.oracle.com/security-alerts/cpujan2020.html PatchVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-2725 US Government Resource