CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2020-01-15
Oracle Coherence and WebLogic Server T3 Protocol Deserialization Remote Code Execution (RCE) Vulnerability (CVE-2020-2555)
[Affected Scope] Oracle Coherence versions 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0, including WebLogic Server environments utilizing these components
[Impact] Unauthenticated remote attackers can exploit this vulnerability via the T3 protocol to execute arbitrary code and achieve complete takeover of the target system
[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict external access to the T3/T3S protocols (default port 7001) using connection filters