CVE-2020-2551

9.8

CVSS
Critical

PUBLISHED

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Supported versions that are...

Exploited in the wild Remote Low complexity No user interaction

Vendor: Oracle Corporation
Product: WebLogic Server
Published: Jan 15, 2020
EPSS: —

Description

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

cisa nuclei_scanner

CVSS scores

CVSS v3.0 9.8 Critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation status

Exploited in the wild

Recorded 2023-11-16 00:00:00 UTC · Source

SSVC decision points

Exploitation: active
Automatable: Yes
Technical impact: total

References

https://www.oracle.com/security-alerts/cpujan2020.html

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source	Added
CISA	Nov 16, 2023

Scanner integrations

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-2551.yaml	Apr 25, 2025

Potential proof of concepts

These PoCs are unverified and could contain malware. Use at your own risk.

LTiDi2000/CVE-2020-2551

github · Created 2022-03-21 03:58:29 UTC · 0 stars

Dido1960/Weblogic-CVE-2020-2551-To-Internet

github · Created 2020-05-24 02:56:12 UTC · 21 stars

CVE-2020-2551 POC to use in Internet

Y4er/CVE-2020-2551

github · Created 2020-02-28 08:46:21 UTC · 333 stars

Weblogic IIOP CVE-2020-2551

hktalent/CVE-2020-2551

github · Created 2020-01-19 13:01:32 UTC · 211 stars

how detect CVE-2020-2551 poc exploit python Weblogic RCE with IIOP

jas502n/CVE-2020-2551

github · Created 2020-01-18 07:08:06 UTC · 79 stars

Weblogic RCE with IIOP

Vulnerability detail