CVE-2019-2856: Critical severity oracle weblogic server vulnerability

Published Jul 23, 2019

Updated

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Application Container - JavaEE). Supported versions that are affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected Software

1 affected component

ORACLE WebLogic Server=12.2.1.3.0

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Event History

Jul 23, 2019

CVE Published

via MITRE·10:31 PM

Data Sourced

via MITRE·10:31 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2019-2856?

CVE-2019-2856 is classified as a critical vulnerability due to its ease of exploitation by unauthenticated attackers.

How do I fix CVE-2019-2856?

To mitigate CVE-2019-2856, users should upgrade their Oracle WebLogic Server to version 12.2.1.3.0 or apply the latest security patches provided by Oracle.

What can an attacker do with CVE-2019-2856?

An attacker exploiting CVE-2019-2856 can compromise the Oracle WebLogic Server without authentication, potentially gaining unauthorized access to sensitive data.

Which versions of Oracle WebLogic Server are affected by CVE-2019-2856?

CVE-2019-2856 affects Oracle WebLogic Server version 12.2.1.3.0.

Is network access required to exploit CVE-2019-2856?

Yes, an attacker requires network access via T3 to exploit CVE-2019-2856.