NetSight
IP …
critical9.8Public exploit code

CVE-2019-2729

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected products

VendorProductAffected versions
OracleCommunications Diameter Signaling Router
Versions 8.0, 8.1, 8.2, 8.2.1
OracleCommunications Network Integrity
from 7.3.2 through 7.3.6
OracleHyperion Infrastructure Technology
Versions 11.1.2.4, 11.2.5.0
OracleIdentity Manager
Versions 11.1.2.3.0, 12.2.1.3.0
OraclePeoplesoft Enterprise Peopletools
Versions 8.56, 8.57, 8.58
OracleRapid Planning
Versions 12.1, 12.2
OracleStoragetek Tape Analytics Sw Tool
Version 2.3
OracleTape Library Acsls
Version 8.5
OracleWeblogic Server
Versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0

Weakness classification

CWE-284

References