CVE-2020-2555

CRITICAL KEV

Oracle Coherence 3.7.1.0/12.1.3.0.0/12.2.1.3-4 - RCE

Title source: llm
STIX 2.1

Description

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Exploits (10)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotemultiple
https://www.exploit-db.com/exploits/48508
exploitdb WORKING POC
by nu11secur1ty · pythonwebappsjava
https://www.exploit-db.com/exploits/48320
nomisec WORKING POC 176 stars
by Y4er · remote
https://github.com/Y4er/CVE-2020-2555
nomisec WORKING POC 47 stars
by wsfengfan · remote
https://github.com/wsfengfan/CVE-2020-2555
nomisec WORKING POC 14 stars
by Maskhe · poc
https://github.com/Maskhe/cve-2020-2555
nomisec STUB 3 stars
by Hu3sky · poc
https://github.com/Hu3sky/CVE-2020-2555
nomisec WORKING POC 1 stars
by Qynklee · remote
https://github.com/Qynklee/POC_CVE-2020-2555
vulncheck_xdb WORKING POC
remote
https://github.com/Y4er/WebLogic-Shiro-shell
vulncheck_xdb SCANNER
remote
https://github.com/0xn0ne/weblogicScanner
metasploit WORKING POC NORMAL
by Jang, Y4er, Shelby Pace, Steve Embling · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/weblogic_deserialize_badattrval.rb

References (9)

Scores

CVSS v3 9.8
EPSS 0.9314
EPSS Percentile 99.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable yes
Technical Impact total

Details

CISA KEV 2021-11-03
VulnCheck KEV 2020-10-20
InTheWild.io 2021-07-23
ENISA EUVD EUVD-2020-22348
CWE
CWE-502
Status published
Products (22)
oracle/access_manager 11.1.2.3.0
oracle/coherence 3.7.1.0
oracle/coherence 12.1.3.0.0
oracle/coherence 12.2.1.3.0
oracle/coherence 12.2.1.4.0
oracle/commerce_platform 11.0.0
oracle/commerce_platform 11.1.0
oracle/commerce_platform 11.2.0
oracle/commerce_platform 11.3.0 - 11.3.2
oracle/communications_diameter_signaling_router 8.0.0 - 8.2.2
... and 12 more
Published Jan 15, 2020
KEV Added Nov 03, 2021
Tracked Since Feb 18, 2026