{"id":"CVE-2019-2729","published":"2019-06-19T22:24:10Z","modified":"2024-10-15T19:01:01Z","title":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services)","vendor":"Oracle Corporation","product":"WebLogic Server","tier":"core","eol":null,"affectedVersions":[{"vendor":"Oracle Corporation","product":"WebLogic Server","versions":["10.3.6.0.0","12.1.3.0.0","12.2.1.3.0"]}],"description":{"text":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","provenance":"source","from":"CVE.org"},"summary":{"text":"A critical vulnerability in Oracle WebLogic Server allows an unauthenticated attacker with network access via HTTP to take over the server. It affects supported versions 10.3.6.0.0, 12.1.3.0.0, and 12.2.1.3.0.","provenance":"ai","model":"deepseek-v4-flash","generatedAt":"2026-10-23T03:20:04Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.8883,"percentile":0.99775,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2019-05-01","exploitedFirstSeen":"2019-05-01","ransomware":true,"evidence":[{"url":"https://digital.nhs.uk/cyber-alerts/2019/cc-3044","date":"2019-05-01"},{"url":"https://www.netwitness.com/wp-content/uploads/FIN13-Elephant-Beetle-NetWitness.pdf","date":"2022-08-01"},{"url":"https://www.ivanti.com/resources/v/doc/pr-survey-report/ransomware-quarterly-indexreport_q2-q3","date":"2022-10-21"},{"url":"https://info.securin.io/hubfs/Securin%20Ransomware%20Report%202023.pdf","date":"2023-02-14"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":2,"pulses":[{"name":"CVE Data","url":"https://otx.alienvault.com/pulse/69929b597293fe5837b9c95c","created":"2026-02-16"},{"name":"2022 UNIT 42 NETWORK THREAT TRENDS RESEARCH REPORT","url":"https://otx.alienvault.com/pulse/630e439ea98624c5bb1d4545","created":"2022-08-30"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["x_refsource_MISC"]},{"url":"http://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2729-5570780.html","tags":["x_refsource_MISC"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/155886/Oracle-Weblogic-10.3.6.0.0-Remote-Command-Execution.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpujul2021.html","tags":["x_refsource_MISC"]}],"techniques":[{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-12368","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-12368","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":47895,"url":"https://www.exploit-db.com/exploits/47895","title":"Oracle Weblogic 10.3.6.0.0 - Remote Command Execution","type":"webapps","platform":"java","date":"2020-01-09","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2020-01-09"},"pocGithub":{"count":4,"skipped":0,"earliest":"2020-01-09","earliestUrl":"https://github.com/waffl3ss/CVE-2019-2729","repos":[{"name":"ruthlezs/CVE-2019-2729-Exploit","url":"https://github.com/ruthlezs/CVE-2019-2729-Exploit","stars":45,"created":"2020-02-19"},{"name":"waffl3ss/CVE-2019-2729","url":"https://github.com/waffl3ss/CVE-2019-2729","stars":7,"created":"2020-01-09"},{"name":"pizza-power/weblogic-CVE-2019-2729-POC","url":"https://github.com/pizza-power/weblogic-CVE-2019-2729-POC","stars":3,"created":"2021-05-31"},{"name":"Luchoane/CVE-2019-2729_creal","url":"https://github.com/Luchoane/CVE-2019-2729_creal","stars":3,"created":"2022-09-22"}]},"nuclei":[{"id":"CVE-2019-2729","name":"Oracle WebLogic Server Administration Console - Remote Code Execution","severity":"critical","path":"http/cves/2019/CVE-2019-2729.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-2729.yaml"}],"first":{"date":"2020-01-09","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/47895"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/155886/Oracle-Weblogic-10.3.6.0.0-Remote-Command-Execution.html"],"flow":[{"stage":"related","techniques":["T1190","T1059"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2019-05-01","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://digital.nhs.uk/cyber-alerts/2019/cc-3044","provenance":"source"},{"date":"2019-06-19","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2019-2729","provenance":"source"},{"date":"2020-01-09","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-47895); later: PoC-in-GitHub 2020-01-09","url":"https://www.exploit-db.com/exploits/47895","provenance":"source"}],"speed":{"daysToPublicExploit":204,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":77.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2738 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9978"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 NVD exploit link; 4 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":1.08,"detail":"2 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}