oracle weblogic-server CVE-2020-2551 is a vulnerability in Oracle Weblogic Server
Published on January 15, 2020

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Vendor Advisory NVD

Known Exploited Vulnerability

This Oracle Fusion Middleware Unspecified Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Oracle Fusion Middleware contains an unspecified vulnerability in the WLS Core Components that allows an unauthenticated attacker with network access via IIOP to compromise the WebLogic Server.

The following remediation steps are recommended / required by December 7, 2023: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Vulnerability Analysis

CVE-2020-2551 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.


Products Associated with CVE-2020-2551

You can be notified by stack.watch whenever vulnerabilities like CVE-2020-2551 are published in these products:

Oracle Weblogic Server
 

What versions of Weblogic Server are vulnerable to CVE-2020-2551?