CVE-2020-2551

published 2020-01-15

CVE-2020-2551: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Supported versions that are affected are…

Priority P1 98 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

KEV ITW EXPLOIT Initial access

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected

8 ranges

Vendor	Product	Version range	Fixed in
oracle	weblogic_server	—	—
oracle	weblogic_server	—	—
oracle	weblogic_server	—	—
oracle	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—

Detection & IOCs extracted from sources · hover to see the quote

port IIOP↗

snort

alert tcp $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET INFO Oracle T3 Response with CVE-2020-2551 Vulnerable Version (10.3.6)"; flow:established,to_client; content:"HELO|3a|10.3.6"; startswith; fast_pattern; classtype:policy-violation; sid:2030131; rev:3; metadata:attack_target Server, created_at 2020_05_08, cve CVE_2020_2551, deployment Perimeter, performance_impact Low, confidence High, signature_severity Informational, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_07;)

snort

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT Possible Oracle WebLogic CVE-2020-2551 Scanning"; flow:established,to_server; content:"|47 49 4f 50 01 02 00 03 00 00 00 17 00 00 00 02 00 00 00 00 00 00 00 0b 4e 61 6d 65 53 65 72 76 69 63 65|"; startswith; fast_pattern; reference:url,www.rapid7.com/db/vulnerabilities/oracle-weblogic-cve-2020-2551; reference:url,github.com/hktalent/CVE-2020-2551/blob/master/CVE-2020-2551.py; classtype:attempted-admin; sid:2030128; rev:1; metadata:attack_target Server, created_at 2020_05_08, cve CVE_2020_2551, deployment Perimeter, performance_impact Low, confidence Medium, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_05_08;)

bytes

47 49 4f 50 01 02 00 03 00 00 00 17 00 00 00 02 00 00 00 00 00 00 00 0b 4e 61 6d 65 53 65 72 76 69 63 65

bytes

HELO:10.3.6

• → Exploit traffic uses the GIOP/IIOP protocol; scan detection triggers on a GIOP request frame starting with bytes 47 49 4f 50 ("GIOP") followed by a NameService lookup payload directed at WebLogic servers.
• → Vulnerable WebLogic servers can be identified by their T3 protocol banner response beginning with 'HELO:10.3.6' (or other affected version strings); monitor outbound T3 responses from servers for these version strings.
• → Nuclei template fingerprints vulnerable WebLogic instances by fetching /console/login/LoginForm.jsp and matching version strings (10.3.6.0, 12.1.3.0, 12.2.1.3, 12.2.1.4) in the response body alongside the string 'WebLogic'.
• → Shodan/FOFA queries can identify exposed WebLogic instances: search for http.title:"oracle peoplesoft sign-in" or product:"oracle weblogic" to find potentially vulnerable internet-facing targets.
• → The vulnerability is exploitable over the IIOP protocol (not HTTP); ensure IIOP ports are blocked at the perimeter for unauthenticated external access to WebLogic servers. ↗

• · The Snort rule for scanning detection (sid:2030128) is classified 'confidence Medium' — it may produce false positives on legitimate GIOP/IIOP traffic to WebLogic servers; tune accordingly.
• · The T3 banner detection rule (sid:2030131) is informational severity only — it identifies vulnerable version exposure, not active exploitation; use it for asset inventory rather than alerting on active attacks.
• · The Nuclei HTTP-based detection template only confirms version exposure via the login page, not successful exploitation; a version match indicates a potentially vulnerable target, not a confirmed compromise.

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

vulncheck 9.8 CRITICAL

cisa 9.8 CRITICAL

vendor_oracle 9.8 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.