CVE-2020-2555
published 2020-01-15CVE-2020-2555: Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are…
PriorityP1100critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2022-05-03
Exploited in the wild
EPSS
97.12%
99.9th percentile
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | access_manager | — | — |
| oracle | coherence | — | — |
| oracle | coherence | — | — |
| oracle | coherence | — | — |
| oracle | coherence | — | — |
| oracle | commerce_platform | — | — |
| oracle | commerce_platform | — | — |
| oracle | commerce_platform | — | — |
| oracle | commerce_platform | 11.3.0 – 11.3.2 | — |
| oracle | communications_diameter_signaling_router | 8.0.0 – 8.2.2 | — |
| oracle | healthcare_data_repository | — | — |
| oracle | rapid_planning | — | — |
| oracle | rapid_planning | — | — |
| oracle | retail_assortment_planning | — | — |
| oracle | retail_assortment_planning | — | — |
| oracle | utilities_framework | — | — |
| oracle | utilities_framework | — | — |
| oracle | utilities_framework | — | — |
| oracle | utilities_framework | — | — |
| oracle | utilities_framework | 4.3.0.1.0 – 4.3.0.6.0 | — |
| oracle | webcenter_portal | — | — |
| oracle | webcenter_portal | — | — |
| oracle_corporation | utilities_framework | — | — |
| oracle_corporation | utilities_framework | — | — |
| oracle_corporation | utilities_framework | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
74332031322e322e310a41533a323535
- →Detect CVE-2020-2555 exploitation by monitoring for serialized BadAttributeValueExpException objects sent over the T3 protocol to WebLogic's default port (TCP 7001). ↗
- →Monitor T3/T3S protocol traffic to Oracle WebLogic Server for deserialization payloads containing Coherence gadget chain classes: com.tangosol.util.extractor.ChainedExtractor, com.tangosol.util.extractor.ReflectionExtractor, and com.tangosol.util.filter.LimitFilter. ↗
- →Alert on T3 handshake bytes '74332031322e322e310a41533a323535' (ASCII: 't3 12.2.1\nAS:255') arriving on TCP port 7001, which is the T3 protocol handshake used by exploit tooling for this CVE. ↗
- →Monitor BIRemotingServlet on TCP port 7780 for unauthenticated AMF (Action Message Format) deserialization requests; exploitation of CVE-2020-2950 via this endpoint can chain the same Coherence gadget chains for RCE. ↗
- →Detect version fingerprinting attempts against WebLogic by monitoring for HTTP GET requests to /console/login/LoginForm.jsp, which exploit tooling uses to confirm vulnerable versions before launching the T3 deserialization payload. ↗
- →Look for ysoserial gadget chains (BeanShell1, Jython1, CommonsCollections2, CommonsBeanutils1, CommonsCollections4, Groovy1) combined with Coherence-specific classes in deserialization traffic, as these are the documented full gadget chain entry points for this vulnerability. ↗
- ·Affected versions are Oracle Coherence 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0; the Metasploit module targets WebLogic versions 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0 and uses slightly different serialized payload structures per version (e.g., add_class_desc is conditionally omitted for 12.1.3.0.0). ↗
- ·The vulnerability is in the Coherence library itself, not exclusively WebLogic; any application with the Coherence library in its code path where there is a path to deserialization is also vulnerable, including Oracle Business Intelligence deployed on WebLogic. ↗
- ·CVE-2020-2555's patch was incomplete; CVE-2020-2883 is a bypass of the same patch, meaning systems patched only for CVE-2020-2555 (January 2020 CPU) remain exploitable via the bypass until the April 2020 CPU is applied. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
cisa9.8CRITICAL
vendor_oracle9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Oracle Multiple Products Remote Code Execution Vulnerability
cisa·2021-11-03·CVSS 9.8
CVE-2020-2555 [CRITICAL] CWE-502 Oracle Multiple Products Remote Code Execution Vulnerability
Vulnerability: Oracle Multiple Products Remote Code Execution Vulnerability
Affected: Oracle Multiple Products
Multiple Oracle products contain a remote code execution vulnerability that allows an unauthenticated attacker with network access via T3 or HTTP to takeover the affected system. Impacted Oracle products: Oracle Coherence in Fusion Middleware, Oracle Utilities Framework, Oracle Retail Assortment Planning, Oracle Commerce, Oracle Communications Diameter Signaling Router (DSR).
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2020-2555
Remediation Due Date: 2022-05-03
Oracle
Oracle Oracle Commerce Risk Matrix: Dynamo Application Framework (Coherence) — CVE-2020-2555
vendor_oracle·2021-07-15·CVSS 9.8
CVE-2020-2555 [CRITICAL] Oracle Oracle Commerce Risk Matrix: Dynamo Application Framework (Coherence) — CVE-2020-2555
Oracle Oracle Commerce Risk Matrix: Dynamo Application Framework (Coherence) vulnerability
CVE: CVE-2020-2555
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2021 (JUL 2021)
Oracle
Oracle Oracle Utilities Applications Risk Matrix: General (Oracle Coherence) — CVE-2020-2555
vendor_oracle·2021-01-15·CVSS 9.8
CVE-2020-2555 [CRITICAL] Oracle Oracle Utilities Applications Risk Matrix: General (Oracle Coherence) — CVE-2020-2555
Oracle Oracle Utilities Applications Risk Matrix: General (Oracle Coherence) vulnerability
CVE: CVE-2020-2555
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2021 (JAN 2021)
Oracle
Oracle Oracle Communications Risk Matrix: IDIH (Oracle Coherence) — CVE-2020-2555
vendor_oracle·2020-10-15·CVSS 9.8
CVE-2020-2555 [CRITICAL] Oracle Oracle Communications Risk Matrix: IDIH (Oracle Coherence) — CVE-2020-2555
Oracle Oracle Communications Risk Matrix: IDIH (Oracle Coherence) vulnerability
CVE: CVE-2020-2555
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2020 (OCT 2020)
Oracle
Oracle Oracle Retail Applications Risk Matrix: Application Core (Coherence) — CVE-2020-2555
vendor_oracle·2020-07-15·CVSS 9.8
CVE-2020-2555 [CRITICAL] Oracle Oracle Retail Applications Risk Matrix: Application Core (Coherence) — CVE-2020-2555
Oracle Oracle Retail Applications Risk Matrix: Application Core (Coherence) vulnerability
CVE: CVE-2020-2555
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2020 (JUL 2020)
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Caching,CacheStore,Invocation — CVE-2020-2555
vendor_oracle·2020-01-15·CVSS 9.8
CVE-2020-2555 [CRITICAL] Oracle Oracle Fusion Middleware Risk Matrix: Caching,CacheStore,Invocation — CVE-2020-2555
Oracle Oracle Fusion Middleware Risk Matrix: Caching,CacheStore,Invocation vulnerability
CVE: CVE-2020-2555
CVSS: 9.8
Protocol: T3
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2020 (JAN 2020)
GHSA
GHSA-gm93-pfh3-mrf3: Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation)
ghsa_unreviewed·2022-05-24
CVE-2020-2555 [HIGH] CWE-502 GHSA-gm93-pfh3-mrf3: Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation)
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
VulnCheck
Oracle Multiple Products Remote Code Execution Vulnerability
vulncheck·2020·CVSS 9.8
CVE-2020-2555 [CRITICAL] CWE-502 Oracle Multiple Products Remote Code Execution Vulnerability
Oracle Multiple Products Remote Code Execution Vulnerability
Multiple Oracle products contain a remote code execution vulnerability that allows an unauthenticated attacker with network access via T3 or HTTP to takeover the affected system. Impacted Oracle products: Oracle Coherence in Fusion Middleware, Oracle Utilities Framework, Oracle Retail Assortment Planning, Oracle Commerce, Oracle Communications Diameter Signaling Router (DSR).
Affected: Oracle Multiple Products
Required Action: Apply updates per vendor instructions.
Exploitation References: https://cisa.gov/news-events/cybersecurity-advisories/aa20-275a; https://media.defense.gov/2020/Oct/20/2002519884/-1/-1/0/CSA_CHINESE_EXPLOIT_VULNERABILITIES_UOO179811.PDF; https://us-cert.cisa.gov/ncas/alerts/aa20-275a; https://www.cisa.go
Suricata
ET EXPLOIT Oracle Coherence Deserialization RCE (CVE-2020-2555)
suricata·2021-12-20·CVSS 9.8
CVE-2020-2555 [CRITICAL] ET EXPLOIT Oracle Coherence Deserialization RCE (CVE-2020-2555)
ET EXPLOIT Oracle Coherence Deserialization RCE (CVE-2020-2555)
Rule: alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Oracle Coherence Deserialization RCE (CVE-2020-2555)"; flow:established,to_server; content:"|74 33 20 31 32 2e 32 2e 31 0a 41 53 3a 32 35 35|"; content:"javax.management.BadAttributeValueExpException"; nocase; fast_pattern; content:"weblogic.common.internal.PackageInfo"; reference:url,github.com/Y4er/CVE-2020-2555/blob/master/weblogic_t3.py; reference:url,www.zerodayinitiative.com/blog/2020/3/5/cve-2020-2555-rce-through-a-deserialization-bug-in-oracles-weblogic-server; reference:cve,2020-2555; classtype:attempted-admin; sid:2034780; rev:1; metadata:attack_target Server, created_at 2021_12_20, cve CVE_2020_2555, deployment Perimeter, confidence High, signature
Exploit-DB
WebLogic Server - Deserialization RCE - BadAttributeValueExpException (Metasploit)
exploitdb·2020-05-22·CVSS 9.8
CVE-2020-2555 [CRITICAL] WebLogic Server - Deserialization RCE - BadAttributeValueExpException (Metasploit)
WebLogic Server - Deserialization RCE - BadAttributeValueExpException (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'WebLogic Server Deserialization RCE - BadAttributeValueExpException',
'Description' => %q{
There exists a Java object deserialization vulnerability
in multiple versions of WebLogic.
Unauthenticated remote code execution can be achieved
by sending a serialized BadAttributeValueExpException object
over the T3 protocol to vulnerable WebLogic servers.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Jang', # Vuln Discovery
'Y4er', # PoC
'Shelby Pace' # Metasploit Module
],
'References' =>
[
[ 'CVE', '2020-2555' ],
[ 'URL', 'https://www.thezdi.com/blo
Exploit-DB
Oracle WebLogic Server 12.2.1.4.0 - Remote Code Execution
exploitdb·2020-04-14·CVSS 9.8
CVE-2020-2555 [CRITICAL] Oracle WebLogic Server 12.2.1.4.0 - Remote Code Execution
Oracle WebLogic Server 12.2.1.4.0 - Remote Code Execution
---
# Exploit Title: Oracle WebLogic Server 12.2.1.4.0 - Remote Code Execution
# Author: nu11secur1ty
# Date: 2020-03-31
# Vendor: Oracle
# Software Link: https://download.oracle.com/otn/nt/middleware/12c/122140/fmw_12.2.1.4.0_wls_Disk1_1of1.zip
# Exploit link: https://github.com/nu11secur1ty/Windows10Exploits/tree/master/Undefined/CVE-2020-2555
# CVE: CVE-2020-2555
[+] Credits: Ventsislav Varbanovski (nu11secur1ty)
[+] Source: readme from GitHUB
[Exploit Program Code]
#!/usr/bin/python
# @nu11secur1ty
import socket
import os
import sys
import struct
if len(sys.argv) ' % os.path.basename(sys.argv[0])
sys.exit()
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(5)
server_address = (sys.argv[1], int(sy
Metasploit
WebLogic Server Deserialization RCE - BadAttributeValueExpException
metasploit
WebLogic Server Deserialization RCE - BadAttributeValueExpException
WebLogic Server Deserialization RCE - BadAttributeValueExpException
There exists a Java object deserialization vulnerability in multiple versions of WebLogic. Unauthenticated remote code execution can be achieved by sending a serialized BadAttributeValueExpException object over the T3 protocol to vulnerable WebLogic servers.
Qualys
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
blogs_qualys·2022-02-23
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
#### Table of Contents
- Situation
- Directive Scope
- CISA Catalog of Known Exploited Vulnerabilities
- Detect CISA Vulnerabilities Using Qualys VMDR
- CISA Exploited RTI
- Detailed Operational Dashboard
- Remediation
- Federal Enterprises and Agencies Can Act Now
- Summary
- Getting Started
CISA released a directive in November 2021, recommending urgent and prioritized remediation of actively exploited vulnerabilities. Both government agencies and corporations should heed this advice. This blog outlines how Qualys Vulnerability Management, Detection & Response can be used by any organization to respond to this directive efficiently and effectively.
## Situation
Last November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a Binding Operational Directiv
Trendmicro
Manage Zero Day Exploits (ZDI) with Trend Micro Solutions
blogs_trendmicro·2021-04-28
Manage Zero Day Exploits (ZDI) with Trend Micro Solutions
Cyberbedrohungen
## How Trend Micro Helps Manage Exploited Vulnerabilities
As technological innovations evolve, protecting companies from cyber threats tomorrow secures their businesses today. Read how Trend Micro protects customers from vulnerability exploits by blocking them as early as possible.
By: Jon Clay Apr 28, 2021 Read time: ( words)
Save to Folio
As technological innovations evolve, protecting companies from cyber threats tomorrow secures their businesses today. Exploiting known vulnerabilities to successfully compromise an organization has long been a common tactic used by malicious actors. Whether Heartbleed, EternalBlue, or most recently Zerologon, threat actors take advantage of newly disclosed vulnerabilities in their attacks. But even with thousands of new vulnerabili
Trendmicro
Manage Zero Day Exploits (ZDI) with Trend Micro Solutions
blogs_trendmicro·2021-04-28
Manage Zero Day Exploits (ZDI) with Trend Micro Solutions
Cyber Threats
## How Trend Micro Helps Manage Exploited Vulnerabilities
As technological innovations evolve, protecting companies from cyber threats tomorrow secures their businesses today. Read how Trend Micro protects customers from vulnerability exploits by blocking them as early as possible.
By: Jon Clay 2021/04/28 Read time: ( words)
Save to Folio
As technological innovations evolve, protecting companies from cyber threats tomorrow secures their businesses today. Exploiting known vulnerabilities to successfully compromise an organization has long been a common tactic used by malicious actors. Whether Heartbleed, EternalBlue, or most recently Zerologon, threat actors take advantage of newly disclosed vulnerabilities in their attacks. But even with thousands of new vulnerabilities
Trendmicro
Manage Zero Day Exploits (ZDI) with Trend Micro Solutions
blogs_trendmicro·2021-04-28
Manage Zero Day Exploits (ZDI) with Trend Micro Solutions
Minacce cyber
## How Trend Micro Helps Manage Exploited Vulnerabilities
As technological innovations evolve, protecting companies from cyber threats tomorrow secures their businesses today. Read how Trend Micro protects customers from vulnerability exploits by blocking them as early as possible.
By: Jon Clay Apr 28, 2021 Read time: ( words)
Save to Folio
As technological innovations evolve, protecting companies from cyber threats tomorrow secures their businesses today. Exploiting known vulnerabilities to successfully compromise an organization has long been a common tactic used by malicious actors. Whether Heartbleed, EternalBlue, or most recently Zerologon, threat actors take advantage of newly disclosed vulnerabilities in their attacks. But even with thousands of new vulnerabilitie
Trendmicro
Manage Zero Day Exploits (ZDI) with Trend Micro Solutions
blogs_trendmicro·2021-04-28
Manage Zero Day Exploits (ZDI) with Trend Micro Solutions
Ciberamenazas
## How Trend Micro Helps Manage Exploited Vulnerabilities
As technological innovations evolve, protecting companies from cyber threats tomorrow secures their businesses today. Read how Trend Micro protects customers from vulnerability exploits by blocking them as early as possible.
By: Jon Clay Apr 28, 2021 Read time: ( words)
Save to Folio
As technological innovations evolve, protecting companies from cyber threats tomorrow secures their businesses today. Exploiting known vulnerabilities to successfully compromise an organization has long been a common tactic used by malicious actors. Whether Heartbleed, EternalBlue, or most recently Zerologon, threat actors take advantage of newly disclosed vulnerabilities in their attacks. But even with thousands of new vulnerabilitie
Trendmicro
Manage Zero Day Exploits (ZDI) with Trend Micro Solutions
blogs_trendmicro·2021-04-28
Manage Zero Day Exploits (ZDI) with Trend Micro Solutions
Cyber Threats
## How Trend Micro Helps Manage Exploited Vulnerabilities
As technological innovations evolve, protecting companies from cyber threats tomorrow secures their businesses today. Read how Trend Micro protects customers from vulnerability exploits by blocking them as early as possible.
By: Jon Clay Apr 28, 2021 Read time: ( words)
Save to Folio
As technological innovations evolve, protecting companies from cyber threats tomorrow secures their businesses today. Exploiting known vulnerabilities to successfully compromise an organization has long been a common tactic used by malicious actors. Whether Heartbleed, EternalBlue, or most recently Zerologon, threat actors take advantage of newly disclosed vulnerabilities in their attacks. But even with thousands of new vulnerabilitie
Trendmicro
Manage Zero Day Exploits (ZDI) with Trend Micro Solutions
blogs_trendmicro·2021-04-28
Manage Zero Day Exploits (ZDI) with Trend Micro Solutions
Cyber Threats
# How Trend Micro Helps Manage Exploited Vulnerabilities
As technological innovations evolve, protecting companies from cyber threats tomorrow secures their businesses today. Read how Trend Micro protects customers from vulnerability exploits by blocking them as early as possible.
By: Jon Clay
2021/04/28
Read time: ( words)
Save to Folio
Photo credit: pxhere
As technological innovations evolve, protecting companies from cyber threats tomorrow secures their businesses today. Exploiting known vulnerabilities to successfully compromise an organization has long been a common tactic used by malicious actors. Whether Heartbleed, EternalBlue, or most recently Zerologon, threat actors take advantage of newly disclosed vulnerabilities in their attacks. But even with thousands o
Tenable
CVE-2020-14882: Oracle WebLogic Remote Code Execution Vulnerability Exploited in the Wild
blogs_tenable·2020-10-29·CVSS 9.8
[CRITICAL] CVE-2020-14882: Oracle WebLogic Remote Code Execution Vulnerability Exploited in the Wild
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
Government Agencies Warn of State-Sponsored Actors Exploiting Publicly Known Vulnerabilities
blogs_tenable·2020-10-23
Government Agencies Warn of State-Sponsored Actors Exploiting Publicly Known Vulnerabilities
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
NSA Alert: Chinese State-Sponsored Actors Exploit Known Vulnerabilities | Qualys
blogs_qualys·2020-10-22·CVSS 9.8
CVE-2020-15505 [CRITICAL] NSA Alert: Chinese State-Sponsored Actors Exploit Known Vulnerabilities | Qualys
#### Table of Contents
- Detect 25 Publicly Known Vulnerabilities using VMDR
Update November 25, 2020: The UK National Cyber Security Centre alerts that APT nation-state groups and cybercriminals are exploiting MobileIron RCE vulnerability (CVE-2020-15505).
Original post: On October 20, 2020, the United States National Security Agency (NSA) released a cybersecurity advisory on Chinese state-sponsored malicious cyber activity. The NSA alert provided a list of 25 publicly known vulnerabilities that are known to be recently leveraged by cyber actors for various hacking operations.
“Since these techniques include exploitation of publicly known vulnerabilities, it is critical that network defenders prioritize patching and
mitigation efforts,” said the NSA advisory. It also recommended “crit
Qualys
NSA Alert: Chinese State-Sponsored Actors Exploit Known Vulnerabilities
blogs_qualys·2020-10-22·CVSS 10.0
CVE-2020-15505 [CRITICAL] NSA Alert: Chinese State-Sponsored Actors Exploit Known Vulnerabilities
## Table of Contents
Detect 25 Publicly Known Vulnerabilities using VMDR
Update November 25, 2020 : The UK National Cyber Security Centre alerts that APT nation-state groups and cybercriminals are exploiting MobileIron RCE vulnerability (CVE-2020-15505).
Original post : On October 20, 2020, the United States National Security Agency (NSA) released a cybersecurity advisory on Chinese state-sponsored malicious cyber activity. The NSA alert provided a list of 25 publicly known vulnerabilities that are known to be recently leveraged by cyber actors for various hacking operations.
“Since these techniques include exploitation of publicly known vulnerabilities, it is critical that network defenders prioritize patching and mitigation efforts,” said the NSA advisory. It also recommended “critic
Tenable
Oracle Critical Patch Update for October 2020 Addresses 402 Security Updates
blogs_tenable·2020-10-21
Oracle Critical Patch Update for October 2020 Addresses 402 Security Updates
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
CVE-2020-2883: Oracle WebLogic Deserialization Vulnerability Exploited in the Wild
blogs_tenable·2020-05-13·CVSS 9.8
[CRITICAL] CVE-2020-2883: Oracle WebLogic Deserialization Vulnerability Exploited in the Wild
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Trendmicro
Oracle WebLogic Vulnerability
blogs_trendmicro·2020-05-11·CVSS 9.8
CVE-2020-2555 [CRITICAL] Oracle WebLogic Vulnerability
## Details on the Oracle WebLogic Vulnerability Being Exploited in the Wild
Learn about one major Oracle WebLogic vulnerability being exploited in the wild.
By: Zero Day Initiative May 11, 2020 Read time: ( words)
Save to Folio
Earlier this year, I blogged about a deserialization vulnerability in the Oracle WebLogic Server. This was patched by Oracle and assigned CVE-2020-2555. However, researcher Quynh Le of VNPT ISC submitted a bug to the ZDI that showed how the patch could be bypassed. This bug, labeled CVE-2020-2883 , is now being reported by Oracle as being used in active attacks. In this blog post, we will go through the details of this recently-patched vulnerability.
Any ability to invoke ChainedExtractor.extract() will still result in remote code execution. The report from Quy
Trendmicro
Oracle WebLogic Vulnerability
blogs_trendmicro·2020-05-11·CVSS 9.8
CVE-2020-2555 [CRITICAL] Oracle WebLogic Vulnerability
# Details on the Oracle WebLogic Vulnerability Being Exploited in the Wild
Learn about one major Oracle WebLogic vulnerability being exploited in the wild.
By: Zero Day Initiative
2020/05/11
Read time: ( words)
Save to Folio
Earlier this year, I blogged about a deserialization vulnerability in the Oracle WebLogic Server. This was patched by Oracle and assigned CVE-2020-2555. However, researcher Quynh Le of VNPT ISC submitted a bug to the ZDI that showed how the patch could be bypassed. This bug, labeled CVE-2020-2883, is now being reported by Oracle as being used in active attacks. In this blog post, we will go through the details of this recently-patched vulnerability.
Patch Bypass
The original patch for CVE-2020-2555 did not address the lower portion of the following gadget chain:
Trendmicro
Oracle WebLogic Vulnerability
blogs_trendmicro·2020-05-11·CVSS 9.8
CVE-2020-2555 [CRITICAL] Oracle WebLogic Vulnerability
## Details on the Oracle WebLogic Vulnerability Being Exploited in the Wild
Learn about one major Oracle WebLogic vulnerability being exploited in the wild.
By: Zero Day Initiative 2020/05/11 Read time: ( words)
Save to Folio
Earlier this year, I blogged about a deserialization vulnerability in the Oracle WebLogic Server. This was patched by Oracle and assigned CVE-2020-2555. However, researcher Quynh Le of VNPT ISC submitted a bug to the ZDI that showed how the patch could be bypassed. This bug, labeled CVE-2020-2883 , is now being reported by Oracle as being used in active attacks. In this blog post, we will go through the details of this recently-patched vulnerability.
Any ability to invoke ChainedExtractor.extract() will still result in remote code execution. The report from Quynh
Tenable
Oracle January 2020 Critical Patch Update Contains 255 CVEs
blogs_tenable·2020-01-15
Oracle January 2020 Critical Patch Update Contains 255 CVEs
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
http://packetstormsecurity.com/files/157054/Oracle-Coherence-Fusion-Middleware-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/157207/Oracle-WebLogic-Server-12.2.1.4.0-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/157795/WebLogic-Server-Deserialization-Remote-Code-Execution.htmlhttps://www.oracle.com/security-alerts/cpujan2020.htmlhttps://www.oracle.com/security-alerts/cpujan2021.htmlhttps://www.oracle.com/security-alerts/cpujul2020.htmlhttps://www.oracle.com/security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttp://packetstormsecurity.com/files/157054/Oracle-Coherence-Fusion-Middleware-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/157207/Oracle-WebLogic-Server-12.2.1.4.0-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/157795/WebLogic-Server-Deserialization-Remote-Code-Execution.htmlhttps://www.oracle.com/security-alerts/cpujan2020.htmlhttps://www.oracle.com/security-alerts/cpujan2021.htmlhttps://www.oracle.com/security-alerts/cpujul2020.htmlhttps://www.oracle.com/security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-2555
2020-01-15
Published
2021-11-03
Added to CISA KEV
Exploited in the wild