E20-10n81
CVSS:
9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
False Positive:
f
Variants:
4
Year:
2020
Description
This strike exploits an insecure deserialization vulnerability in Oracle Coherence library, which is used in popular products such as Oracle WebLogic Server.
The vulnerability lies in the 'MvelExtractor.class' in the Coherence REST library.
The vulnerability is a result of insufficient validation of T3 requests. The server allows deserialization of classes in objects embedded with T3 protocol messages.
Successful exploitation leads to remote code execution, in the context of the user running the Oracle WebLogic Service.
