CVE-2020-2519: Medium severity ORACLE WebLogic Server vulnerability

Published Jan 15, 2020

Updated

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebLogic Server. CVSS 3.0 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L).

Affected Software

4 affected components

ORACLE WebLogic Server=10.3.6.0.0

ORACLE WebLogic Server=12.1.3.0.0

ORACLE WebLogic Server=12.2.1.3.0

ORACLE WebLogic Server=12.2.1.4.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Oracle WebLogic Server (Console) / Oracle Fusion Middleware to a version that resolves this vulnerability.
Fixed in 10.3.6.0.0
Upgrade
Upgrade Oracle WebLogic Server (Console) / Oracle Fusion Middleware to a version that resolves this vulnerability.
Fixed in 12.1.3.0.0
Upgrade
Upgrade Oracle WebLogic Server (Console) / Oracle Fusion Middleware to a version that resolves this vulnerability.
Fixed in 12.2.1.3.0
Upgrade
Upgrade Oracle WebLogic Server (Console) / Oracle Fusion Middleware to a version that resolves this vulnerability.
Fixed in 12.2.1.4.0

Event History

Jan 15, 2020

CVE Published

via MITRE·04:33 PM

Data Sourced

via MITRE·04:33 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:15 PM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2020-2519?

The severity of CVE-2020-2519 is rated as critical due to its ability to allow unauthenticated attackers to execute arbitrary code remotely.

How do I fix CVE-2020-2519?

To fix CVE-2020-2519, apply the latest patch provided by Oracle for the affected WebLogic Server versions.

Which versions of Oracle WebLogic Server are affected by CVE-2020-2519?

The affected versions include Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0.

Can CVE-2020-2519 be exploited remotely?

Yes, CVE-2020-2519 can be exploited remotely by attackers with network access via HTTP.

Is authentication required to exploit CVE-2020-2519?

No, authentication is not required to exploit CVE-2020-2519, making it particularly dangerous.