Oracle WebLogic Server Multiple Remote Security Vulnerabilities

Bugtraq ID:	109240
Class:	Unknown
CVE:	CVE-2019-2856 CVE-2019-2824 CVE-2019-2827
Remote:	Yes
Local:	No
Published:	Jul 16 2019 12:00AM
Updated:	Jul 16 2019 12:00AM
Credit:	Kamlapati Choubey of Trend Micro working with Trend Micro's Zero Day Initiative, Minle Chen of PingAn Galaxy Lab, Matthias Kaiser of Apple Information Security
Vulnerable:	Oracle Weblogic Server 12.2.1.3.0 Oracle Weblogic Server 12.1.3.0.0 Oracle Weblogic Server 10.3.6.0.0
Not Vulnerable:

Oracle WebLogic Server Multiple Remote Security Vulnerabilities

Oracle WebLogic Server is prone to multiple remote remote security vulnerabilities.

These vulnerabilities can be exploited over the 'HTTP' and 'T3' protocol. The 'WLS Core' and 'Application Container - JavaEE' components are affected.

These vulnerabilities affect the following supported versions:
10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0

Oracle WebLogic Server Multiple Remote Security Vulnerabilities

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Oracle WebLogic Server Multiple Remote Security Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Oracle WebLogic Server Multiple Remote Security Vulnerabilities

References:

• Oracle Homepage (Oracle)
  
• Oracle Critical Patch Update Advisory - July 2019 (Oracle)