CVE-2019-2725: high-severity vulnerability in Oracle Corporation Tape Library ACSLS
Published · Updated
100Vexday Risk Score
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
ssvc Actcvss 7.5epss 100%
from disclosure to weapon0 days
Published on NVDApr 26
1st PoCSep 13
metasploitApr 23
CISA KEV+990d
exploitation probability
100%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
40 public exploit(s)
Action required by CISAfederal deadline: 2022-07-10
Apply updates per vendor instructions.
In short
A flaw in Oracle WebLogic Server's Web Services component allows attackers to take control of the server without needing to log in. An attacker only needs network access via HTTP to exploit this vulnerability.
Technical detail
Unauthenticated remote code execution vulnerability in Oracle WebLogic Server (versions 10.3.6.0.0 and 12.1.3.0.0) Web Services subcomponent, exploitable via HTTP with no authentication required (network vector, low complexity). Successful exploitation results in complete compromise of server confidentiality, integrity, and availability.
Summary generated and translated by AI from the official description.
The full analysis of this CVE is available in Portuguese →
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Oracle Corporation · Tape Library ACSLSpublic PoCs found — 40✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/46814exploitdbwww.exploit-db.com/exploits/46780unverifiedgithubgithub.com/shack2/javaserializetools★ 514githubgithub.com/lufeirider/CVE-2019-2725★ 432githubgithub.com/SkyBlueEternal/CNVD-C-2019-48814-CNNVD-201904-961★ 105githubgithub.com/black-mirror/Weblogic★ 69githubgithub.com/pimps/CVE-2019-2725★ 52githubgithub.com/jiansiting/CVE-2019-2725★ 35githubgithub.com/lasensio/cve-2019-2725★ 21githubgithub.com/kerlingcode/CVE-2019-2725★ 11githubgithub.com/zhusx110/cve-2019-2725★ 7githubgithub.com/ianxtianxt/CVE-2019-2725★ 3githubgithub.com/leerina/CVE-2019-2725★ 2githubgithub.com/welove88888/CVE-2019-2725★ 2githubgithub.com/GGyao/weblogic_2019_2725_wls_batch★ 2githubgithub.com/ludy-dev/Oracle-WLS-Weblogic-RCE★ 2githubgithub.com/davidmthomsen/CVE-2019-2725★ 1githubgithub.com/loursha/Oracle-Weblogic-Server-AsyncResponseService-Deserialization-Remote-Code-Execution-CVE-2019-2725★ 0githubgithub.com/CalegariMindSec/Exploit-CVE-2019-2725★ 0githubgithub.com/peterpeter228/CNTA-2019-0014xCVE-2019-2725★ 0githubgithub.com/1stPeak/CVE-2019-2725-environment★ 0githubgithub.com/N0b1e6/CVE-2019-2725-POC★ 0vulncheckvulncheck.com/xdb/4aff13e21cd5unverifiedvulncheckvulncheck.com/xdb/99f9740a5a03unverifiedvulncheckvulncheck.com/xdb/2957146db3b3unverifiedvulncheckvulncheck.com/xdb/561ad5895b63unverifiedvulncheckvulncheck.com/xdb/596e707e613eunverifiedcve_referencepacketstormsecurity.com/files/152756/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.htmlunverifiedvulncheckvulncheck.com/xdb/78cfc32167c4unverifiedvulncheckvulncheck.com/xdb/25131e431549unverifiedcve_referencewww.exploit-db.com/exploits/46780/unverifiedvulncheckvulncheck.com/xdb/5888723944a0unverifiedvulncheckvulncheck.com/xdb/1e4c0da55540unverifiedvulncheckvulncheck.com/xdb/ebedc9f5eb85unverifiedvulncheckvulncheck.com/xdb/5f7ca038e0a6unverifiedvulncheckvulncheck.com/xdb/42ac084ae399unverifiedvulncheckvulncheck.com/xdb/927806a24931unverifiedvulncheckvulncheck.com/xdb/50cca2cb6c66unverifiedvulncheckvulncheck.com/xdb/717e8523f747unverifiedvulncheckvulncheck.com/xdb/71278e8e69ebunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://packetstormsecurity.com/files/152756/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.htmlhttps://support.f5.com/csp/article/K90059138https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-2725https://www.exploit-db.com/exploits/46780/https://www.oracle.com/security-alerts/alert-cve-2019-2725.html#AppendixFMWhttps://www.oracle.com/security-alerts/cpujan2020.htmlhttp://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.htmlhttp://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlhttp://www.securityfocus.com/bid/108074