$ cve CVE-2019-2725 JSON

CVE-2019-2725 KEV EXPLOIT

9.8

CRITICAL · CVSS 3.1 · EPSS 100% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-07-10.

Description

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	99.96% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-74
On CISA KEV	yes — remediate by 2022-07-10
Public exploit	yes
Published	2019-04-26
Last modified	2026-08-25

CISA KEV

Name	Oracle WebLogic Server, Injection
Added	2022-01-10
Due	2022-07-10
Vendor / product	Oracle / WebLogic Server
Ransomware use	known

Affected (8)

Vendor	Product
oracle	agile product lifecycle management
oracle	communications converged application server
oracle	peoplesoft enterprise peopletools
oracle	storagetek tape analytics sw tool
oracle	tape library acsls
oracle	tape virtual storage manager gui
oracle	vm virtualbox
oracle	weblogic server

Public exploits

Source	Title	Date
exploit-db	Oracle Weblogic Server - 'AsyncResponseService' Deserialization Remote Code Execution (Metasploit)	2019-05-08
exploit-db	Oracle Weblogic 10.3.6.0.0 / 12.1.3.0.0 - Remote Code Execution	2019-04-30

References

→ the Explorer · watch your stack · NVD