{"id":10620,"date":"2020-05-19T09:50:32","date_gmt":"2020-05-19T09:50:32","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=10620"},"modified":"2026-04-17T18:07:49","modified_gmt":"2026-04-17T18:07:49","slug":"weblogic-remote-code-execution-vulnerabilities-cve-2020-2883-and-cve-2020-2884-protection-solution","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/weblogic-remote-code-execution-vulnerabilities-cve-2020-2883-and-cve-2020-2884-protection-solution\/","title":{"rendered":"WebLogic Remote Code Execution Vulnerabilities (CVE-2020-2883 and CVE-2020-2884) Protection Solution"},"content":{"rendered":"\n

Overview<\/strong><\/h2>\n\n\n\n

Oracle released Critical Patch Update (CPU) for April 2020 that fixes multiple vulnerabilities of different risk levels, including two critical ones (CVE-2020-2883 and CVE-2020-2884) with a CVSS score of 9.8 that allow unauthenticated attackers with network access via T3 to compromise vulnerable Oracle WebLogic Server. Successful exploitation could result in takeover of Oracle WebLogic Server, hence remote code execution.<\/p>\n\n\n\n

The two vulnerabilities that exist in the Core component of WebLogic Server could be exploited without authentication or additional interaction. Since the T3 protocol is enabled by default on the WebLogic console, the two vulnerabilities can cause an extensive impact. Affected users are strongly advised to apply protection measures as soon as possible for risk aversion.<\/p>\n\n\n\n\n\n\n\n

Researchers from NSFOCUS has reproduced the preceding vulnerabilities immediately upon their discovery.<\/p>\n\n\n\n

\"Red<\/figure>\n\n\n\n

For details about the Oracle CPU, please visit the following link:<\/p>\n\n\n\n

\nhttps:\/\/www.oracle.com\/security-alerts\/cpuapr2020.html\n<\/div><\/figure>\n\n\n\n

Affected Versions<\/strong><\/h2>\n\n\n\n