Oracle WebLogic Server 10.3.6.0.0/12.1.3.0.0/12.2.1.3.0 TFA Collectorjackson-databind information disclosure

Summaryinfo

A vulnerability, which was classified as critical, has been found in Oracle WebLogic Server 10.3.6.0.0/12.1.3.0.0/12.2.1.3.0. This vulnerability affects unknown code of the component TFA Collectorjackson-databind. This manipulation causes information disclosure. This vulnerability is handled as CVE-2019-2888. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Oracle WebLogic Server 10.3.6.0.0/12.1.3.0.0/12.2.1.3.0 (Application Server Software). Affected by this vulnerability is an unknown functionality of the component TFA Collectorjackson-databind. The manipulation with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. The summary by CVE is:

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: EJB Container). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

The weakness was released 10/16/2019 as Oracle Critical Patch Update Advisory - October 2019 as confirmed advisory (Website). The advisory is shared at oracle.com. This vulnerability is known as CVE-2019-2888. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Entries connected to this vulnerability are available at VDB-143620, VDB-143661, VDB-143632 and VDB-143631. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Application Server Software

Vendor

• Oracle

Name

• WebLogic Server

Version

• 10.3.6.0.0
• 12.1.3.0.0
• 12.2.1.3.0

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion