ZeroDay Findings
Sign inSign up

Findings

CVE-2019-2725

Oracle WebLogic Server, Injection

Published Apr 26, 2019 · updated Oct 1, 2026 · oracle agile product lifecycle management

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Timeline

Detection, updates, and resolution for this record.

  1. Apr 26, 2019 · Catalog

    Detected

    Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Serve

  2. Jan 10, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jul 10, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Oct 1, 2026 · Catalog

    Updated

    Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Serve

Required action

Apply updates per vendor instructions.

CISA due date Jul 10, 2022

Affected

  • cpe oracle/agile product lifecycle management9.3.3
  • cpe oracle/agile product lifecycle management9.3.4
  • cpe oracle/agile product lifecycle management9.3.5
  • cpe oracle/communications converged application server5.1
  • cpe oracle/communications converged application server7.0
  • cpe oracle/communications converged application server7.1
  • cpe oracle/peoplesoft enterprise peopletools8.56
  • cpe oracle/peoplesoft enterprise peopletools8.57
  • vendor Oracle WebLogic Serverversion unspecified

Sources

  • CISA KEVCVE-2019-2725

    Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).

    cisa.gov
  • CVE.orgCVE-2019-2725

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2019-2725

    30-day exploitation probability 100.0%

    first.org
  • Exploit Database46780

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit Database46814

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesexploit_multi/misc/weblogic_deserialize_asyncresponseservice

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2019-2725

    Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to com

    nvd.nist.gov

References