EXPLOIT/ALERT Back to feed

Tape Library ACSLS vulnerability

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Published 26 Apr 2019Updated 1 Oct 20261441 sources
CVSS 9.8 ✓ VERIFIED REFERENCE△ CISA KEV
Overview Sources History

What happened

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected versions

Tape Library ACSLS: 8.5 Fixed: See vendor advisory.

Why it matters

Review the vendor advisory and exposure of the affected product to determine operational impact.

Detection & mitigation

  • Apply vendor-provided updates or mitigations.
  • Review affected product exposure and access logs.

Public PoC references

RepositoryAuthorFirst seenReference
www.exploit-db.comNVD reference2019-04-26VerifiedExploit-DB 46814Oracle Weblogic Server - 'AsyncResponseService' Deserialization Remote Code Execution (Metasploit)Metasploit2019-05-08VerifiedExploit-DB 46780Oracle Weblogic 10.3.6.0.0 / 12.1.3.0.0 - Remote Code ExecutionAvinash Kumar Thapa2019-04-30VerifiedPoC-in-GitHub · shack2/javaserializetoolsJava反序列化漏洞利用工具V1.0 Java反序列化相关漏洞的检查工具，采用JDK 1.8+NetBeans8.2开发，软件运行必须安装JDK 1.8或者以上版本。 支持：weblogic xml反序列化漏洞 CVE-2017-10271/CNVD-C-2019-48814/CVE-2019-2725检查。★ 518shack22018-09-13CandidatePoC-in-GitHub · SkyBlueEternal/CNVD-C-2019-48814-CNNVD-201904-961CVE-2019-2725poc汇总 更新绕过CVE-2017-10271补丁POC★ 105SkyBlueEternal2019-04-25CandidatePoC-in-GitHub · lasensio/cve-2019-2725★ 21lasensio2019-05-01CandidatePoC-in-GitHub · davidmthomsen/CVE-2019-2725★ 1davidmthomsen2019-05-02CandidatePoC-in-GitHub · leerina/CVE-2019-2725★ 2leerina2019-05-05CandidatePoC-in-GitHub · zhusx110/cve-2019-2725★ 7zhusx1102019-05-10CandidatePoC-in-GitHub · peterpeter228/CNTA-2019-0014xCVE-2019-2725★ 0peterpeter2282019-05-14CandidatePoC-in-GitHub · lufeirider/CVE-2019-2725CVE-2019-2725 命令回显★ 432lufeirider2019-05-29CandidatePoC-in-GitHub · welove88888/CVE-2019-2725★ 2welove888882019-06-11CandidatePoC-in-GitHub · jiansiting/CVE-2019-2725weblogic绕过和wls远程执行★ 35jiansiting2019-06-15CandidatePoC-in-GitHub · kerlingcode/CVE-2019-2725CVE-2019-2725 bypass pocscan and exp★ 11kerlingcode2019-06-16CandidatePoC-in-GitHub · black-mirror/WeblogicWeblogic CVE-2019-2725 CVE-2019-2729 Getshell 命令执行★ 70black-mirror2019-06-24CandidatePoC-in-GitHub · pimps/CVE-2019-2725WebLogic Insecure Deserialization - CVE-2019-2725 payload builder & exploit★ 52pimps2019-08-23CandidatePoC-in-GitHub · ianxtianxt/CVE-2019-2725CVE-2019-2725★ 3ianxtianxt2019-11-05CandidatePoC-in-GitHub · N0b1e6/CVE-2019-2725-POCCVE-2019-2725-POC★ 0N0b1e62019-12-12CandidatePoC-in-GitHub · GGyao/weblogic_2019_2725_wls_batchweblogic CVE-2019-2725利用exp。★ 2GGyao2020-01-08CandidatePoC-in-GitHub · ludy-dev/Oracle-WLS-Weblogic-RCE(CVE-2019-2725) Oracle WLS(Weblogic) RCE test sciript★ 2ludy-dev2020-08-31CandidatePoC-in-GitHub · CalegariMindSec/Exploit-CVE-2019-2725A simple exploit for CVE-2019-2725.★ 0CalegariMindSec2023-11-11CandidatePoC-in-GitHub · loursha/Oracle-Weblogic-Server-AsyncResponseService-Deserialization-Remote-Code-Execution-CVE-2019-2725Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.★ 0loursha2026-01-19CandidateSploitusPenetration test project replicating an attack chain using a WebLogic deserialization flaw.zwenn662026-10-12T06:39:21Verifiedzwenn66/ATTACK-Pentest-LabPenetration test project replicating an attack chain using a WebLogic deserialization flaw.zwenn662026-10-12T06:39:21Verified
CorrectionsReport an issue