A critical vulnerability, codenamed CVE-2019-2729, has been found in multiple versions of Oracle WebLogic Server. The company is advising its customers to apply the security update that was released as soon as possible.
The vulnerability has already been discovered by hackers and is being used to carry out attacks. That is why the company stressed that the update must be done very quickly in order to protect its customers.
Oracle has released some information about the vulnerability CVE-2019-2729. Hackers can exploit the vulnerability to execute coderemotelywithout having to verify their identity. That is, they can carry out an attackwithout having to enter a username and password.
This is not the first time Oracle's WebLogic Servers have faced this particular security issue. In April, Oracle issued a patch for a similar vulnerability (CVE-2019-2725), which was also being used by hackers to spread ransomware and cryptominers.
Researchers claim that the new vulnerability CVE-2019-2729 bypasses the patchthat was released for CVE-2019-2725.
KnownSec 404 had advised users to do some things to reduce the risk, before Oracle released the update.
The advice given by the companyis as follows:
- Find and delete wls9_async_response.war, wls-wsat.war and restart the Weblogic service or
- Prevent access to /_async/* and /wls-wsat/* URL paths. This advice still applies now, for those who cannot apply the new update immediately.
The vulnerability , unlike CVE-2019-2725, does not affect all WebLogic versions, but only: 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0.
Oracle WebLogic is a Java EE application server, part of Oracle's Fusion Middleware, and supports many popular databases. That's why it's a favorite target for hackers. It's also the choice of many organizations, so hackers target it to gain access to a lot of data.
