CVE-2019-2725Oracle WebLogic Server, Injection
Explotación conocida — Oracle WebLogic Server, Injection
CISA confirmó el 10.01.2022 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 10.07.2022.
Acción requerida: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2019-2725
Descripción
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| oracle | agile product lifecycle management | 9.3.3 | |
| oracle | communications converged application server | 5.1 | |
| oracle | peoplesoft enterprise peopletools | 8.56 | |
| oracle | storagetek tape analytics sw tool | 2.3 | |
| Oracle Corporation | Tape Library ACSLS | 8.5 | |
| oracle | tape virtual storage manager gui | 6.2 | |
| oracle | vm virtualbox | < 5.2.36 | |
| oracle | weblogic server | 10.3.6.0.0 |
Referencias y parches
- 108074 vdb-entryBroken Link
- http://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html PatchVendor Advisory
- https://support.f5.com/csp/article/K90059138 Third Party Advisory
- 46780 exploitExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/152756/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html Third Party AdvisoryVDB Entry
- http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html PatchVendor Advisory
- https://www.oracle.com/security-alerts/cpujan2020.html PatchVendor Advisory
- https://www.oracle.com/security-alerts/alert-cve-2019-2725.html#AppendixFMW PatchVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-2725 US Government Resource
Coincidencias CPE (NVD) (18)
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.4:*:*:*:*:*:*:*cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.5:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_converged_application_server:5.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_converged_application_server:7.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_converged_application_server:7.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool:2.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:tape_library_acsls:8.5:*:*:*:*:*:*:*cpe:2.3:a:oracle:tape_virtual_storage_manager_gui:6.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*< 5.2.36cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*≥ 6.0.0 < 6.0.16cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*≥ 6.1.0 < 6.1.2cpe:2.3:a:oracle:vm_virtualbox:5.2.36:*:*:*:*:*:*:*cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*