Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
This indicates an attack attempt to exploit an Insecure Deserialization Vulnerability in Oracle WebLogic Server.A remote attacker could exploit this vulnerability by encrypting a crafted serialized object and sending it in a crafted T3 message to the target server. Successful exploitation can result in result in arbitrary code execution under the security context of the affected server.
Oracle WebLogic Server 10.3.6.0.0
Oracle WebLogic Server 12.1.3.0.0
Oracle WebLogic Server 12.2.1.3.0
Oracle WebLogic Server 12.2.1.4.0
System Compromise: Remote attackers can gain control of vulnerable systems.
Apply the most recent upgrade or patch from the vendor.
https://www.oracle.com/security-alerts/cpuapr2020.html
| CVE Infomation | Exploits or more Infomation |
|---|---|
| mitre | EXPLOIT DATABASE |
| NVD | 0day.today |
| vulmon.com | github |
| CVE Details | |
| JVN ENG JPN | |
| Reconshell |
Software Tag: Linux(1 tweets) Weblogic(2 tweets)
List of frequently cited URLs
| User | URL | Info Source | Date |
|---|---|---|---|
| hack_git | https://github.com/hktalent/CVE_2020_2546 | Source hack_git 1635299226899951616 | 2023/03/14 |
| hack_git | https://t.me/hackgit/7881 | Source hack_git 1635299226899951616 | 2023/03/14 |
| hack_git | https://twitter.com/hack_git/status/1635299226899951616/pho... | Source hack_git 1635299226899951616 | 2023/03/14 |
| ksg93rd | https://github.com/regorsec/Linux-Post-Exploitation | Source ksg93rd 1635324522894336001 | 2023/03/14 |
List of frequently cited URLs
| URL | Num of Times Referred to |
|---|---|
| newsbythehour.org | 32 |
| lists.astaro.com | 27 |
| bit.ly | 5 |
| www.us-cert.gov | 5 |
| github.com | 4 |
| www.zdnet.com | 4 |
| www.tenable.com | 4 |
| ift.tt | 3 |
| twitter.com | 3 |
| seclists.org | 3 |
| threatpost.com | 3 |
| www.oracle.com | 3 |
| blogs.oracle.com | 3 |
| tweetedtimes.com | 3 |
| www.zerodayinitiative.com | 3 |
| User | URL | Info Source |
|---|---|---|
| hack_git | github.com | Show Tweet |
| hack_git | t.me | Show Tweet |
| hack_git | twitter.com | Show Tweet |
| ksg93rd | github.com | Show Tweet |
| Name | URL |
|---|---|
| zhzyker/exphub | https://github.com/zhzyker/exphub |
| Y4er/CVE-2020-2883 | https://github.com/Y4er/CVE-2020-2883 |
| hktalent/CVE_2020_2546 | https://github.com/hktalent/CVE_2020_2546 |
| zzwlpx/weblogicPoc | https://github.com/zzwlpx/weblogicPoc |
| Y4er/WebLogic-Shiro-shell | https://github.com/Y4er/WebLogic-Shiro-shell |
| MagicZer0/Weblogic_CVE-2020-2883_POC | https://github.com/MagicZer0/Weblogic_CVE-2020-2883_POC |
| Al1ex/CVE-2020-2883 | https://github.com/Al1ex/CVE-2020-2883 |
| FancyDoesSecurity/CVE-2020-2883 | https://github.com/FancyDoesSecurity/CVE-2020-2883 |
| zhzyker/vulmap | https://github.com/zhzyker/vulmap |
| 0xn0ne/weblogicScanner | https://github.com/0xn0ne/weblogicScanner |
| Name | URL |
|---|---|
| zhzyker/exphub | github.com |
| Y4er/CVE-2020-2883 | github.com |
| hktalent/CVE_2020_2546 | github.com |
| zzwlpx/weblogicPoc | github.com |
| Y4er/WebLogic-Shiro-shell | github.com |
| MagicZer0/Weblogic_CVE-2020-2883_POC | github.com |
| Al1ex/CVE-2020-2883 | github.com |
| FancyDoesSecurity/CVE-2020-2883 | github.com |
| zhzyker/vulmap | github.com |
| 0xn0ne/weblogicScanner | github.com |