CVE-2019-2725Oracle WebLogic Server, Injection
Aktif olarak istismar ediliyor — Oracle WebLogic Server, Injection
CISA bu açığın gerçek saldırılarda kullanıldığını 10.01.2022 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 10.07.2022.
Gerekli işlem: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2019-2725
Açıklama
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| oracle | agile product lifecycle management | 9.3.3 | |
| oracle | communications converged application server | 5.1 | |
| oracle | peoplesoft enterprise peopletools | 8.56 | |
| oracle | storagetek tape analytics sw tool | 2.3 | |
| Oracle Corporation | Tape Library ACSLS | 8.5 | |
| oracle | tape virtual storage manager gui | 6.2 | |
| oracle | vm virtualbox | < 5.2.36 | |
| oracle | weblogic server | 10.3.6.0.0 |
Kaynaklar ve yamalar
- 108074 vdb-entryBroken Link
- http://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html PatchVendor Advisory
- https://support.f5.com/csp/article/K90059138 Third Party Advisory
- 46780 exploitExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/152756/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html Third Party AdvisoryVDB Entry
- http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html PatchVendor Advisory
- https://www.oracle.com/security-alerts/cpujan2020.html PatchVendor Advisory
- https://www.oracle.com/security-alerts/alert-cve-2019-2725.html#AppendixFMW PatchVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-2725 US Government Resource
CPE eşleşmeleri (NVD) (18)
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.4:*:*:*:*:*:*:*cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.5:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_converged_application_server:5.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_converged_application_server:7.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_converged_application_server:7.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool:2.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:tape_library_acsls:8.5:*:*:*:*:*:*:*cpe:2.3:a:oracle:tape_virtual_storage_manager_gui:6.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*< 5.2.36cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*≥ 6.0.0 < 6.0.16cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*≥ 6.1.0 < 6.1.2cpe:2.3:a:oracle:vm_virtualbox:5.2.36:*:*:*:*:*:*:*cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*