Published: 15/01/2020 Updated: 25/10/2022

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 674

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Vulnerable Product	Search on Vulmon	Subscribe to Product
oracle webcenter portal 12.2.1.3.0
oracle utilities framework 4.2.0.3.0
oracle utilities framework 4.2.0.2.0
oracle retail assortment planning 15.0
oracle utilities framework 4.4.0.0.0
oracle retail assortment planning 16.0
oracle coherence 12.2.1.3.0
oracle coherence 12.1.3.0.0
oracle coherence 3.7.1.0
oracle coherence 12.2.1.4.0
oracle webcenter portal 12.2.1.4.0
oracle rapid planning 12.1
oracle rapid planning 12.2
oracle utilities framework
oracle utilities framework 4.4.0.2.0
oracle communications diameter signaling router
oracle healthcare data repository 7.0.1
oracle commerce platform
oracle commerce platform 11.0.0
oracle commerce platform 11.1.0
oracle commerce platform 11.2.0

This Metasploit module exploits a Java object deserialization vulnerability in multiple versions of WebLogic Unauthenticated remote code execution can be achieved by sending a serialized BadAttributeValueExpException object over the T3 protocol to vulnerable WebLogic servers ...

Oracle WebLogic Server version 122140 suffers from a remote code execution vulnerability ...

Oracle Coherence Fusion Middleware remote code execution exploit Supported versions that are affected are 37117, 121300, 122130 and 122140 ...

CVE-2020-2555 Python POC

CVE-2020-2555 1984-0daycom wwwyoutubecom/watch?v=VzmZTYbm4Zw python CVE-2020-2555py ip port testser

weblogic t3 deserialization rce, support replying message from rmi sever

weblogic_hpcmd weblogic t3 deserialization rce, support replying message from rmi sever The original project fork from: weblogic_cmd, intend to keep updating 利用文章见：Weblogic T3 反序列化回显利用(CVE-2020-2555) 直接通过加载字节码的方式来加载class，执行无文件生成。通过绑定rmi来实现回显。支持t3s 原版本利用链为CVE-2015

weblogic-framework is the best tool for detecting weblogic vulnerabilities.

weblogic-framework weblogic-framework is the best tool for detecting weblogic vulnerabilities 免责申明本工具仅适用于安全技术研究，严禁使用本工具发起网络黑客攻击，造成的法律后果，请使用者自负。使用方式常用漏洞由于 Weblogic 的补丁是互斥的，安装最新的补丁时需要进行卸载之前的补丁，所以以�

WebLogic T3/IIOP RCE ExternalizableHelper.class of coherence.jar

CVE-2020-14756 WebLogic T3/IIOP RCE ExternalizableHelperclass of coherencejar README project base on githubcom/Y4er/CVE-2020-2555 and weblogic_cmd test on 122140 and jdk 180_221 Reference y4ercom/post/weblogic-cve-2020-14756/ mpweixinqqcom/s/E-4wjbKD-iSi0CEMegVmZQ

weblogic-framework is the best tool for detecting weblogic vulnerabilities.

Weblogic com.tangosol.util.extractor.ReflectionExtractor RCE

CVE-2020-2555 Weblogic comtangosolutilextractorReflectionExtractor RCE comsupereamCVE_2020_2555 /* * author:Y4ercom * * gadget: * BadAttributeValueExpExceptionreadObject() * comtangosolutilfilterLimitFiltertoString() * comtangosolutilextractorChainedExtractorextract() * comtangosolutilextractorReflectionEx

CVE-2020-2555

CVE-2020-2555 运行Mainjava会在当前目录下生成payloadser，该payload可以使用t3协议发到目标服务器

Weblogic Vuln POC EXP cve-2020-2551 cve-2020-2555 cve-2020-2883 ，。。。

weblogicPoc Weblogic Vuln POC EXP cve-2020-2551 cve-2020-2555 cve-2020-2883 ，。。。 Patch CVE-2020-2551 更新原版本（githubcom/Y4er/CVE-2020-2551git）遇到为私有地址的服务器无法直连检测问题。 CVE-2020-2555 更新cve-2020-2555 exp，python脚本。 CVE-2020-2883 更新cve-2020-2883 exp，python脚本。参考 githubcom/Y4er/CVE-

poc for CVE-2020-2555

POC_CVE-2020-2555 poc for CVE-2020-2555 3 part: Client & Server: to build object and send to Server, trigger gadgetchain Use it for build owner object Attack: send object via T3 protocol with pwntools

Weblogic coherence.jar RCE

CVE-2020-2883 先克隆框架 git clone githubcom/Y4er/CVE-2020-2555 然后将 CVE_2020_2883java 放到 src/com/supeream/CVE_2020_2883java 目录下导入idea运行 CVE_2020_2883java RCE! 截图

Attacking_Shiro_with_CVE_2020_2555 详细内容可参考使用 CVE-2020-2555 攻击 Shiro ps 只适用于 Weblogic 12g

WebLogic利用CVE-2020-2883打Shiro rememberMe反序列化漏洞，一键注册蚁剑filter内存shell

Java反序列化技术分享本次分享涉及的东西有以下几点： Java序列化和反序列化基础为什么在反序列化的时候会产生漏洞？ Java反射 ysoserial CommonsCollections2、CommonsCollections5 Java ClassLoader 加载类的几种方法 WebLogic CVE-2020-2555 CVE-2020-2883 RCE Shiro-550 rememberMe 硬编码导致的反序列化RCE WebLogic + Shiro

关于GadgetInspector的二开的一些思考和改进。

针对GadgetInspector的一些思考，感谢前辈们的文章。让整个过程学起来变的轻松起来。这里作为记录防止自己以前写过的东西过快忘记，此文是几月后写的所以写的过于简陋。如看到可以看看文章推荐中的进行学习or看下简陋的源码。文章 ASM学习(b站有视频教学) lsieungithubio/java/asm/in

weblogic-framework 是检测 weblogic 漏洞的最佳工具。

Weblogic_GadGet cve-2020-2555,cve-2020-2883,Your can use it Get RCE!!!

PHP SECURITY CLASS 2021 Homework For Fri 26 Feb Lab: Command Execution Lab: Unrestricted File Inclusion Lab: Secure File Uploads Lab: Insecure CAPTCHA For Thu 25 Feb Lab: Insecure Deserialization Lab: Using Components with Known Vulnerabilities Lab: Insecure Direct Object References Lab: Missing Function Access Level Control (ACL) Lab: Unvalidated Redirects and Forwards

POC for CVE-2020-2883

POC_CVE-2020-2883 POC for CVE-2020-2883 Use it with CVE-2020-2555 Server POC v2 OK POC v1+v3 in working

Takeover of Oracle WebLogic Server

WebLogic RCE Vulnerability - CVE-2020-14882 Introduction CVE-2020-14882 is a remote code execution (RCE) flaw in the Console component of Oracle WebLogic Server The pre-authentication flaw was given an attack complexity of “low” and highlighted as “easily exploitable” by Oracle resulting in it being assigned a critical CVSSv3 score of 98 Successful

Forked from Y4er I added some changes so the code can be built into a simple jar with simple arguments (host, port, command, http/s), to build please replace coherencejar with the version according to your target The jar present in Releases is built for 1213, as is easy to guess Usage: java -jar 12_1_3jar -H [Host] -P [Port] -C [Command] -https [optional] The command is

Yo, sysadmins! Thought Patch Tuesday was big? Oracle says 'hold my Java' with huge 334 security flaw fix bundle

The Register • Shaun Nichols in San Francisco • 15 Jan 2020

House of Larry delivers massive update for 93 products Updated your WordPress plugins lately? Here are 320,000 auth-bypassing reasons why you should

Oracle has released a sweeping set of security patches across the breadth of its software line. The January update, delivered one day after Microsoft, Intel, Adobe, and others dropped their scheduled monthly patches, addresses a total of 334 security vulnerabilities across 93 different products from the enterprise giant. As you may imagine, most IT admins will only need to test and apply a handful of the updates for their specific platforms. For Oracle's flagship Database Server, the update incl...

CVE-2020-2555

Vulnerability Summary

Vulnerability Trend

Exploits

Github Repositories

Recent Articles

References

Vulmon Search

About

Products

Connect