Description
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Oracle | WebLogic Server | 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 8 repositories
-
daybreak-kits/weblogicScanner ★ 2,080 · Jan 15, 2020
weblogic 漏洞扫描工具。目前包含对以下漏洞的检测能力：CVE-2014-4210、CVE-2016-0638、CVE-2016-3510、CVE-2017-3248、CVE-2017-3506、CVE-2017-10271、CVE-2018-2628、CVE-2018-2893、CVE-2018-2894、CVE-2018-3191、CVE-2018-3245、CVE-2018-3252…
-
Y4er/CVE-2020-2551 ★ 336 · Feb 28, 2020
Weblogic IIOP CVE-2020-2551
-
hktalent/CVE-2020-2551 ★ 210 · Jan 19, 2020
how detect CVE-2020-2551 poc exploit python Weblogic RCE with IIOP
-
zzwlpx/weblogicPoc ★ 88 · May 16, 2020
Weblogic Vuln POC EXP cve-2020-2551 cve-2020-2555 cve-2020-2883 ，。。。
-
jas502n/CVE-2020-2551 ★ 79 · Jan 18, 2020
Weblogic RCE with IIOP
-
Dido1960/Weblogic-CVE-2020-2551-To-Internet ★ 22 · May 24, 2020
CVE-2020-2551 POC to use in Internet
-
abbarhissarh/CVE-Exploit ★ 1 · Jun 2, 2022
CVE-2020-2551 Exploiter
-
DaMinGshidashi/CVE-2020-2551 ★ 0 · Sep 2, 2020
Use shell to build weblogic debug environment for CVE-2020-2551
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Oracle WebLogic Server - Remote Code Execution http/cves/2020/CVE-2020-2551.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 1
- WID-SEC-2023-2946 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 16, 2023