Oracle Warns of Critical Remotely Exploitable Weblogic Server Flaws

Oracle on Tuesday released its quarterly Critical Patch Update for July
2021^[1] with 342 fixes spanning
across multiple products, some of which could be exploited by a
remote attacker to take control of an affected system.

Chief among them is CVE-2019-2729^[2], a critical
deserialization vulnerability via XMLDecoder in Oracle WebLogic
Server Web Services that’s remotely exploitable without
authentication. It’s worth noting that the weakness was originally
addressed as part of an out-of-band security update^[3] in June 2019.

Oracle WebLogic Server is an application server that functions
as a platform for developing, deploying, and running enterprise
Java-based applications.

The flaw, which is rated 9.8 out of a maximum of 10 on the CVSS
severity scale, affects WebLogic Server versions 11.1.2.4 and
11.2.5.0 and exists within the Oracle Hyperion Infrastructure
Technology.

Also fixed in WebLogic Server are six other flaws, three of
which have been assigned a CVSS score of 9.8 out of 10 —

This is far from the first time critical issues have been
discovered in WebLogic Server. Earlier this year, Oracle shipped
the April 2021 patch^[4]
with fixes for two bugs (CVE-2021-2135 and CVE-2021-2136), among
others that could be abused to execute arbitrary code.

Oracle customers are advised to move quickly to apply the
updates and protect systems against potential exploitation.