Monday, January 27, 2025
HomeCVE/vulnerabilityCritical Oracle Weblogic Flaw Let Remote Attacker Take Control of The System

Critical Oracle Weblogic Flaw Let Remote Attacker Take Control of The System

Published on

SIEM as a Service

Follow Us on Google News

In the quarterly Critical Patch Update for July 2021, Oracle has released 342 fixes for several of its products range. 

The security experts at Oracle have claimed that among those fixes there are some critical flaws, and a threat actor can easily exploit these flaws remotely.

The most critical one is the deserialization flaw through XMLDecoder in Oracle WebLogic Server Web Services, and this flaw has been tracked as “CVE-2019-2729.”

Flaw profile

  • CVE ID: CVE-2019-2729
  • Affected product: Oracle WebLogic Server
  • Flaw summary: A deserialization vulnerability via XMLDecoder in Oracle WebLogic Server Web Services.
  • CVSS: 9.8
  • Severity: High

Oracle Weblogic Flaw

The CVE-2019-2729 is the deserialization flaw through XMLDecoder in Oracle WebLogic Server Web Services. In short, it is an RCE flaw, which means this vulnerability allows any remote attackers to exploit this critical flaw without any authentication.

Let’s keep it simple; without the username and password, a threat actor can easily exploit this security flaw and take control of the affected system.

Since this security flaw is marked as severe by the experts, that’s why they have strongly advised and recommended all the users to immediately apply the security patches.

Oracle WebLogic Server

For developing, deploying, and running Java-based applications of enterprises the Oracle WebLogic Server was used; so, it’s an application server that operates as a platform for the Java-based apps.

Within the Oracle Hyperion Infrastructure Technology, this security flaw already exist, and it has affected the following WebLogic Server versions:-

  • 11.1.2.4
  • 11.2.5.0 

Other Severe Flaws

Apart from this critical security flaw, the experts have also fixed six other severe vulnerabilities, among them, there are three that have managed to gain a score of 9.8 out of 10, and here they are mentioned below:-

Moreover, with fixes for only two flaws CVE-2021-2135 and CVE-2021-2136, Oracle released the April 2021 patch earlier this year, and to execute arbitrary code the threat actors could have abused these two vulnerabilities.

However, as a security measure and to remain protected against these vulnerabilities, the security researchers have strongly recommended all the users to immediately implement the security patches released by the company.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

White House Considers Oracle-Led Takeover of TikTok with U.S. Investors

In a significant development, the Trump administration is reportedly formulating a plan to prevent...

Critical Vulnerability in IBM Security Directory Enables Session Cookie Theft

IBM has announced the resolution of several security vulnerabilities affecting its IBM Security Directory...

Critical Apache Solr Vulnerability Grants Write Access to Attackers on Windows

A new security vulnerability has been uncovered in Apache Solr, affecting versions 6.6 through...

GitHub Vulnerability Exposes User Credentials via Malicious Repositories

A cybersecurity researcher recently disclosed several critical vulnerabilities affecting Git-related projects, revealing how improper...

API Security Webinar

Free Webinar - DevSecOps Hacks

By embedding security into your CI/CD workflows, you can shift left, streamline your DevSecOps processes, and release secure applications faster—all while saving time and resources.

In this webinar, join Phani Deepak Akella ( VP of Marketing ) and Karthik Krishnamoorthy (CTO), Indusface as they explores best practices for integrating application security into your CI/CD workflows using tools like Jenkins and Jira.

Discussion points

Automate security scans as part of the CI/CD pipeline.
Get real-time, actionable insights into vulnerabilities.
Prioritize and track fixes directly in Jira, enhancing collaboration.
Reduce risks and costs by addressing vulnerabilities pre-production.

More like this

Critical Vulnerability in IBM Security Directory Enables Session Cookie Theft

IBM has announced the resolution of several security vulnerabilities affecting its IBM Security Directory...

Critical Apache Solr Vulnerability Grants Write Access to Attackers on Windows

A new security vulnerability has been uncovered in Apache Solr, affecting versions 6.6 through...

GitHub Vulnerability Exposes User Credentials via Malicious Repositories

A cybersecurity researcher recently disclosed several critical vulnerabilities affecting Git-related projects, revealing how improper...