CVE-2019-2618
First published: Tue Apr 23 2019(Updated: )
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data as well as unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 5.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N).
Credit: secalert_us@oracle.com secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle WebLogic Server | =10.3.6.0.0 | |
| Oracle WebLogic Server | =12.1.3.0.0 | |
| Oracle WebLogic Server | =12.2.1.3.0 | |
| =10.3.6.0.0 | ||
| =12.1.3.0.0 | ||
| =12.2.1.3.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2019-2618?
CVE-2019-2618 is considered easily exploitable and allows high privileged attackers to compromise affected systems.
How do I fix CVE-2019-2618?
To mitigate CVE-2019-2618, apply the latest Oracle WebLogic Server patches provided by Oracle.
Which versions of Oracle WebLogic Server are affected by CVE-2019-2618?
The vulnerable versions include Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0, and 12.2.1.3.0.
What type of attack does CVE-2019-2618 allow?
CVE-2019-2618 allows a high privileged attacker with network access to compromise the affected Oracle WebLogic Server.
Is CVE-2019-2618 an insider threat or remote threat?
CVE-2019-2618 is a remote threat, as it can be exploited by attackers with network access.
- agent/type
- agent/severity
- agent/remedy
- agent/references
- agent/description
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/softwarecombine
- agent/event
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/oracle
- canonical/oracle weblogic server
- version/oracle weblogic server/10.3.6.0.0
- version/oracle weblogic server/12.1.3.0.0
- version/oracle weblogic server/12.2.1.3.0