Lucene search
SAINT CorporationSAINT:9870FA2AA27A04C7E50DC7E0A2A344D0HistoryMay 27, 2020 - 12:00 a.m.
Oracle WebLogic Server BadAttributeValueExpException deserialization
2020-05-2700:00:00
SAINT Corporation
download.saintcorporation.com
47
0.967 High
EPSS
Percentile
99.7%
Added: 05/27/2020
CVE: CVE-2020-2555
Background
Oracle WebLogic Server (formerly BEA WebLogic Server) is a Java web application platform.
Problem
A Java object deserialization vulnerability in WebLogic allows unauthenticated remote code execution by sending a serialized **BadAttributeValueExpException** object over the T3 protocol.
Resolution
Apply the patch referenced in Oracle Critical Patch Update Advisory - January 2020.
References
<https://www.oracle.com/security-alerts/cpujan2020.html>
Limitations
Exploit works on Oracle WebLogic Server 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0 on Windows.
Platforms
Windows
Related
checkpoint_advisories
checkpoint_advisories
Oracle Weblogic Insecure Deserialization (CVE-2020-2555)
2020-04-05 00:00:00
saint
saint
Oracle WebLogic Server BadAttributeValueExpException deserialization
2020-05-27 00:00:00
Oracle WebLogic Server BadAttributeValueExpException deserialization
2020-05-27 00:00:00
prion
prion
Design/Logic Flaw
2020-01-15 17:15:00
nessus
nessus
Oracle Coherence (Jan 2020 CPU)
2020-06-26 00:00:00
Oracle Access Manager Multiple Vulnerabilities (Jul 2021 CPU)
2021-07-22 00:00:00
Oracle WebCenter Portal Multiple Vulnerabilities (Oct 2020 CPU)
2020-11-03 00:00:00
zdi
zdi
githubexploit
githubexploit
Exploit for Deserialization of Untrusted Data in Oracle Webcenter Portal
2020-09-18 12:37:20
Exploit for Vulnerability in Oracle Coherence
2021-01-27 01:24:52
Exploit for Vulnerability in Oracle Weblogic Server
2020-12-30 01:55:52
packetstorm
packetstorm
Oracle WebLogic Server 12.2.1.4.0 Remote Code Execution
2020-04-14 00:00:00
Oracle Coherence Fusion Middleware Remote Code Execution
2020-04-02 00:00:00
WebLogic Server Deserialization Remote Code Execution
2020-05-21 00:00:00
cvelist
cvelist
CVE-2020-2555
2020-01-15 16:34:00
cve
cve
CVE-2020-2555
2020-01-15 17:15:17
zdt
zdt
Oracle Coherence Fusion Middleware Remote Code Execution Exploit
2020-04-03 00:00:00
WebLogic Server Deserialization Remote Code Execution Exploit
2020-05-21 00:00:00
Oracle WebLogic Server 12.2.1.4.0 - Remote Code Execution Exploit
2020-04-14 00:00:00
metasploit
metasploit
WebLogic Server Deserialization RCE - BadAttributeValueExpException
2020-05-04 15:34:15
symantec
symantec
Oracle Coherence CVE-2020-2555 Multiple Remote Security Vulnerabilities
2020-01-14 00:00:00
cisa_kev
cisa_kev
Oracle Multiple Products Remote Code Execution Vulnerability
2021-11-03 00:00:00
exploitdb
exploitdb
Oracle WebLogic Server 12.2.1.4.0 - Remote Code Execution
2020-04-14 00:00:00
0daydb
0daydb
Gym Management System 1.0 - Remote Code Execution
2020-05-25 14:05:47
WebLogic Server CVE-2020-2555 - Remote Code Execution
2020-05-24 15:30:56
OpenEDX Ironwood 2.5 CVE-2020-13144 - Remote Code Execution
2020-05-24 15:29:52
attackerkb
attackerkb
CVE-2020-2883
2020-04-15 00:00:00
CVE-2020-2555
2020-01-15 00:00:00
rapid7blog
rapid7blog
Metasploit 2020 Wrap-Up
2020-12-30 15:38:00
threatpost
threatpost
Bug Parade: NSA Warns on Cresting China-Backed Cyberattacks
2020-10-21 20:31:17
qualysblog
qualysblog
NSA Alert: Chinese State-Sponsored Actors Exploit Known Vulnerabilities
2020-10-22 23:10:29
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR
2022-02-23 05:39:00
ics
ics
Potential for China Cyber Response to Heightened U.S.–China Tensions
2020-10-20 12:00:00
kitploit
kitploit
Vulmap - Web Vulnerability Scanning And Verification Tools
2020-12-25 11:30:00
oracle
oracle
Oracle Critical Patch Update Advisory - January 2021
2021-01-19 00:00:00
Oracle Critical Patch Update Advisory - July 2021
2021-07-20 00:00:00
Oracle Critical Patch Update Advisory - January 2020
2020-01-14 00:00:00