🔙 목록으로 돌아가기

CVE-2020-2551: Oracle WebLogic Server - Remote Code Execution

TitleOracle WebLogic Server - Remote Code Execution
Authordwisiswant0
SeverityCritical
ImpactSuccessful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
RemediationApply the latest security patches provided by Oracle to mitigate this vulnerability.
CVSS Score9.8
EPSS Score0.94412
CVE IDCVE-2020-2551
Shodan Queryhttp.title:"oracle peoplesoft sign-in"product:"oracle weblogic"
Fofa Querytitle="oracle peoplesoft sign-in"
Tags cve2020 cve oracle weblogic rce unauth kev vkev vuln

🔍 Vulnerability Description

Oracle WebLogic Server (Oracle Fusion Middleware (component: WLS Core Components) is susceptible to a remote code execution vulnerability. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 2.2.1.3.0 and 12.2.1.4.0. This easily exploitable vulnerability could allow unauthenticated attackers with network access via IIOP to compromise Oracle WebLogic Server.

🌐 HTTP Request

GET /console/login/LoginForm.jsp HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/14.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-2551.yaml

🦈 Packet Capture: ⬇️ Download cve-2020-2551.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A