CVE-2019-2725

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are...

Basic Information

CVE State: PUBLISHED
Reserved Date: December 14, 2018
Published Date: April 26, 2019
Last Updated: October 01, 2024
Vendor: Oracle Corporation
Product: Tape Library ACSLS
Description: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

CVSS v3.0

7.5 - HIGH

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC Information

Exploitation: active
Automatable: Yes
Technical Impact: partial

Exploit Status

Exploited in the Wild: Yes (added 2022-01-10 00:00:00 UTC) Source
Proof of Concept Available: Yes (added 2019-06-11 00:49:56 UTC) Source
Used in Malware: Yes (added 2022-01-10 00:00:00 UTC) Source

References

http://www.securityfocus.com/bid/108074 http://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html https://support.f5.com/csp/article/K90059138 https://www.exploit-db.com/exploits/46780/ http://packetstormsecurity.com/files/152756/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html https://www.oracle.com/security-alerts/cpujan2020.html https://www.oracle.com/security-alerts/alert-cve-2019-2725.html#AppendixFMW

Known Exploited Vulnerability Information

Source	Added Date
CISA	2022-01-10 00:00:00 UTC

Scanner Integrations

Scanner	URL	Date Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/weblogic_deserialize_asyncresponseservice.rb	2025-04-29 11:01:25 UTC
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-2725.yaml	2025-04-26 00:00:00 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

weblogic_deserialize_asyncresponseservice

Type: metasploit • Created: Unknown

Metasploit module for CVE-2019-2725

ianxtianxt/CVE-2019-2725

Type: github • Created: 2019-11-05 14:35:16 UTC • Stars: 3

CVE-2019-2725

pimps/CVE-2019-2725

Type: github • Created: 2019-08-23 01:42:57 UTC • Stars: 47

WebLogic Insecure Deserialization - CVE-2019-2725 payload builder & exploit

kerlingcode/CVE-2019-2725

Type: github • Created: 2019-06-16 06:17:09 UTC • Stars: 11

CVE-2019-2725 bypass pocscan and exp

jiansiting/CVE-2019-2725

Type: github • Created: 2019-06-15 12:51:19 UTC • Stars: 36

weblogic绕过和wls远程执行

welove88888/CVE-2019-2725

Type: github • Created: 2019-06-11 00:49:56 UTC • Stars: 2

TopScrew/CVE-2019-2725

Type: github • Created: 2019-06-10 05:12:44 UTC • Stars: 190

CVE-2019-2725命令回显+webshell上传+最新绕过

lufeirider/CVE-2019-2725

Type: github • Created: 2019-05-29 01:57:05 UTC • Stars: 438

CVE-2019-2725 命令回显

leerina/CVE-2019-2725

Type: github • Created: 2019-05-05 08:34:20 UTC • Stars: 2

davidmthomsen/CVE-2019-2725

Type: github • Created: 2019-05-02 21:09:36 UTC • Stars: 1

tobechenghuai/CNTA-2019-0014xCVE-2019-2725

Type: github • Created: 2019-04-28 02:18:42 UTC • Stars: 11