Critical · published April 26, 2019
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 100.0th percentile for exploit probability.
🚨 A single HTTP request could lead to a complete takeover of your Oracle WebLogic Server! 😱 Think of it like leaving your front door wide open while you’re away — any passerby can just walk right in and take control of your house without breaking a sweat! 🏠 If an attacker successfully exploits this vulnerability, they could have total control over your WebLogic Server, compromising sensitive data and possibly disrupting services. It’s not just an inconvenience; it could have catastrophic consequences for your organization, affecting confidentiality, integrity, and availability! 🔥
Think of it like leaving your front door wide open while you’re away — any passerby can just walk right in and take control of your house without breaking a sweat! 🏠 CVE-2019-2725 is an easily exploitable vulnerability in the Oracle WebLogic Server that allows unauthenticated attackers with network access via HTTP to compromise the server and execute arbitrary code.
If an attacker successfully exploits this vulnerability, they could have total control over your WebLogic Server, compromising sensitive data and possibly disrupting services. It’s not just an inconvenience; it could have catastrophic consequences for your organization, affecting confidentiality, integrity, and availability! 🔥 To protect your systems, immediately patch to versions 10.3.6.0.0 or 12.1.3.0.0 that have been updated against this vulnerability. Additionally, consider implementing network segmentation to limit access to your WebLogic Server. 🛡️ You’ve got this! Take action now to fortify your defenses and keep your systems safe! 💪✨
| Product | Versions | Fixed in |
|---|---|---|
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/communications_converged_application_server | all versions | — |
| oracle/communications_converged_application_server | all versions | — |
| oracle/communications_converged_application_server | all versions | — |
| oracle/peoplesoft_enterprise_peopletools | all versions | — |
| oracle/peoplesoft_enterprise_peopletools | all versions | — |
| oracle/peoplesoft_enterprise_peopletools | all versions | — |
| oracle/storagetek_tape_analytics_sw_tool | all versions | — |
| oracle/tape_library_acsls | all versions | — |
| oracle/tape_virtual_storage_manager_gui | all versions | — |
| oracle/vm_virtualbox | < 5.2.36 | 5.2.36 |
| oracle/vm_virtualbox | ≥ 6.0.0, < 6.0.16 | 6.0.16 |
| oracle/vm_virtualbox | ≥ 6.1.0, < 6.1.2 | 6.1.2 |
| oracle/vm_virtualbox | all versions | — |
| oracle/weblogic_server | all versions | — |
| oracle/weblogic_server | all versions | — |