| Title | Oracle WebLogic Server - Remote Code Execution |
|---|---|
| Author | dwisiswant0 |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system. |
| Remediation | Apply the latest security patches provided by Oracle to mitigate this vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.94412 |
| CVE ID | CVE-2020-2551 |
| Shodan Query | http.title:"oracle peoplesoft sign-in"product:"oracle weblogic" |
| Fofa Query | title="oracle peoplesoft sign-in" |
| Tags | cve2020 cve oracle weblogic rce unauth kev vkev vuln |
Oracle WebLogic Server (Oracle Fusion Middleware (component: WLS Core Components) is susceptible to a remote code execution vulnerability. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 2.2.1.3.0 and 12.2.1.4.0. This easily exploitable vulnerability could allow unauthenticated attackers with network access via IIOP to compromise Oracle WebLogic Server.
GET /console/login/LoginForm.jsp HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/14.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-2551.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-2551.pcap
N/AN/A