{"id":10030,"date":"2020-02-12T01:46:05","date_gmt":"2020-02-12T01:46:05","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=10030"},"modified":"2026-04-17T18:07:50","modified_gmt":"2026-04-17T18:07:50","slug":"weblogic-wls-component-iiop-protocol-remote-code-execution-vulnerability-cve-2020-2551-threat-alert","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/weblogic-wls-component-iiop-protocol-remote-code-execution-vulnerability-cve-2020-2551-threat-alert\/","title":{"rendered":"WebLogic WLS Component IIOP Protocol Remote Code Execution Vulnerability (CVE-2020-2551) Threat Alert"},"content":{"rendered":"


\n<\/p>\n

    \n
  1. \n

    Overview<\/strong><\/h2>\n<\/li>\n<\/ol>\n

    Oracle released Critical Patch Update (CPU) for January 2020, announcing a remote code execution vulnerability (CVE-2020-2551) in the Internet Inter-ORB Protocol (IIOP) used by the WLA component in WebLogic.<\/p>\n

    This vulnerability exists in the core component of the WebLogic Server and can be triggered when the WebLogic Server is at default settings without administrative authentication and extra interaction, exerting an extensive impact.<\/p>\n

    Via IIOP, an attacker could access the remote interface of the WebLogic Server to deliver malicious data, in a bid to gain server privileges and execute arbitrary code remotely without authorization. Oracle assigns a CVSS score of 9.8 to this vulnerability.<\/p>\n

    The IIOP protocol is used to access remote objects as a Java interface. By default, it is enabled.<\/p>\n

    For details about the Oracle CPU, please visit the following link:<\/p>\n

    https:\/\/www.oracle.com\/security-alerts\/cpujan2020.html<\/strong><\/p>\n

      \n
    1. \n

      Affected Versions<\/strong><\/h2>\n<\/li>\n<\/ol>\n

      The following versions are affected by the CVE-2020-2551 vulnerability:<\/strong><\/p>\n