A vulnerability has been found in Oracle WebLogic Server 10.3.6.0.0/12.1.3.0.0/12.2.1.3.0 (Application Server Software) and classified as critical. This vulnerability affects an unknown function of the component jackson-databind. The manipulation with an unknown input leads to a privilege escalation vulnerability. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

The weakness was released 10/16/2019 as Oracle Critical Patch Update Advisory - October 2019 as confirmed advisory (Website). The advisory is available at oracle.com. This vulnerability was named CVE-2019-2890. The attack can be initiated remotely. The exploitation needs additional levels of successful authentication. The technical details are unknown and an exploit is not available.

Upgrading eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Productinfo

Type

• Application Server Software

Vendor

• Oracle

Name

• WebLogic Server

Version

• 10.3.6.0.0
• 12.1.3.0.0
• 12.2.1.3.0

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion