CVE-2019-2725
CRITICALCVSS 9.8Known ExploitedCISA Known Exploited Vulnerability
https://nvd.nist.gov/vuln/detail/CVE-2019-2725
Remediation deadline: July 10, 2022
Ransomware use: Known
Description
Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).
Timeline
Published:April 26th, 2019 7:29 PM
Last modified:August 25th, 2026 4:28 PM
Added to KEV:January 10th, 2022
CVSS Scoring
CVSS v3: 9.8 (CRITICAL)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2: 7.5
Affected Software
From NVD CPE configuration data
Vendors
oracle
Products
agile_product_lifecycle_managementcommunications_converged_application_serverpeoplesoft_enterprise_peopletoolsstoragetek_tape_analytics_sw_tooltape_library_acslstape_virtual_storage_manager_guivm_virtualboxweblogic_server
Weaknesses (CWE)
References & Reports
Advisories, patches, and third-party reports
- http://packetstormsecurity.com/files/152756/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.htmlThird Party Advisory
- http://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.htmlPatch
- http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlPatch
- http://www.securityfocus.com/bid/108074Broken Link
- https://support.f5.com/csp/article/K90059138Third Party Advisory
- https://www.exploit-db.com/exploits/46780/Exploit
- https://www.oracle.com/security-alerts/alert-cve-2019-2725.html#AppendixFMWPatch
- https://www.oracle.com/security-alerts/cpujan2020.htmlPatch
- http://packetstormsecurity.com/files/152756/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.htmlThird Party Advisory
- http://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.htmlPatch
- http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlPatch
- http://www.securityfocus.com/bid/108074Broken Link
- https://support.f5.com/csp/article/K90059138Third Party Advisory
- https://www.exploit-db.com/exploits/46780/Exploit
- https://www.oracle.com/security-alerts/alert-cve-2019-2725.html#AppendixFMWPatch
- https://www.oracle.com/security-alerts/cpujan2020.htmlPatch
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-2725US Government Resource
Source: NIST NVD · Data may lag official sources by up to one minute