CVE-2020-2801

published 2020-04-15

CVE-2020-2801: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0…

Priority P2 62 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. Note: The patch for this issue will address the vulnerability only if the WLS instance is using JDK 1.7.0_191 or later, or JDK 1.8.0_181 or later. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected

8 ranges

Vendor	Product	Version range	Fixed in
oracle	weblogic_server	—	—
oracle	weblogic_server	—	—
oracle	weblogic_server	—	—
oracle	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → Exploit is delivered over IIOP and T3 protocols — monitor for unauthenticated inbound connections on WebLogic T3/IIOP ports (default 7001, 7002) from untrusted sources as a potential indicator of exploitation attempts targeting CVE-2020-2801. ↗
• → Affected Oracle WebLogic Server versions are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0 — scope detection and patching efforts to these specific versions. ↗

• · The patch for CVE-2020-2801 only fully remediates the vulnerability if the WebLogic instance is running JDK 1.7.0_191 or later, or JDK 1.8.0_181 or later. Patching WebLogic without also ensuring the JDK meets the minimum version requirement leaves the system vulnerable. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

vendor_oracle 9.8 CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.