CVE-2020-2883
Oracle WebLogic Server Unspecified Vulnerability
Description
CVE-2020-2883 is a critical deserialization vulnerability in Oracle WebLogic Server, a widely deployed Java application server within the Oracle Fusion Middleware stack. The flaw affects WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0, allowing an unauthenticated attacker with network access via IIOP or T3 protocols to achieve complete server takeover. With a CVSS v3.1 base score of 9.8, this vulnerability enables remote code execution without any privileges or user interaction. CISA has added CVE-2020-2883 to the Known Exploited Vulnerabilities catalog with a remediation deadline of January 28, 2025, and its ransomware association is currently classified as Unknown. The EPSS score of 94.36% at the 100th percentile places it among the most actively exploited vulnerabilities tracked globally.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| oracle | weblogic server | 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/157950/WebLogic-Server-Deserialization-Remote-Code-Execution.html(Third Party Advisory, VDB Entry)
- https://www.oracle.com/security-alerts/cpuapr2020.html(Vendor Advisory)
- https://www.zerodayinitiative.com/advisories/ZDI-20-504/(Third Party Advisory, VDB Entry)
- https://www.zerodayinitiative.com/advisories/ZDI-20-570/(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-2883(US Government Resource)
Weakness Type
Deserialization of Untrusted Data in WebLogic T3/IIOP Protocols
CVE-2020-2883 exploits unsafe deserialization of Java objects received through WebLogic Server's T3 and IIOP protocol handlers. The WebLogic Server Core component accepts serialized Java objects from remote clients without adequate validation or filtering of the object types being deserialized. An attacker can craft a malicious serialized object that, when deserialized by the server, triggers a chain of method invocations (known as a "gadget chain") leading to arbitrary code execution on the server. Deserialization vulnerabilities in Java application servers are among the most dangerous classes of remote code execution flaws because they require no authentication and can be triggered simply by sending a specially crafted network packet. Learn more about CWE-502: Deserialization of Untrusted Data
Impact Analysis
The impact of CVE-2020-2883 is devastating across all security dimensions, earning the maximum CVSS impact score. Confidentiality is fully compromised because successful exploitation grants the attacker the ability to execute arbitrary code on the WebLogic Server with the privileges of the server process. This means the attacker can access all deployed applications, database connection credentials stored in JDBC configurations, encryption keys, and any data processed by the application server. In enterprise environments, WebLogic Server often serves as the backbone for business-critical applications including ERP systems, financial applications, and customer-facing portals.
Integrity faces maximum impact as the attacker can modify any data accessible to the WebLogic Server process, alter deployed applications to inject backdoors, manipulate business logic, or tamper with transaction data. The attacker can also install persistent access mechanisms such as web shells, scheduled tasks, or modified application components that survive server restarts.
Availability is completely at risk because the attacker can shut down the server, consume system resources through crypto-mining or other malicious processes, or corrupt the server installation to prevent legitimate operation. The combination of network accessibility (AV:N), low attack complexity (AC:L), no required privileges (PR:N), and no user interaction (UI:N) makes this vulnerability trivially exploitable at scale. The EPSS score of 94.36% at the 100th percentile confirms that this vulnerability is being exploited more actively than virtually every other tracked vulnerability, and organizations running unpatched WebLogic Server instances face near-certain compromise.
Exploit Maturity
CVE-2020-2883 has reached the highest level of exploit maturity with multiple publicly available exploits, confirmed active exploitation in the wild, and inclusion in CISA's Known Exploited Vulnerabilities catalog. The EPSS score of 94.36% at the 100th percentile places it at the absolute peak of exploitation activity globally.
A fully functional remote code execution exploit has been published on PacketStorm Security, providing a ready-to-use attack tool. The vulnerability was initially reported through the Zero Day Initiative, with detailed advisories published at ZDI-20-504 and ZDI-20-570, which provide technical details about the deserialization gadget chains involved. CISA has mandated remediation by January 28, 2025, via its KEV catalog entry, though the ransomware association remains Unknown. Given the wide availability of exploit code and the simplicity of exploitation, any internet-facing WebLogic Server running affected versions should be considered an active target.
Remediation
-
Apply Oracle's Critical Patch Update immediately. Install the security patch released in Oracle's April 2020 Critical Patch Update for WebLogic Server. This patch addresses the deserialization vulnerability in the T3 and IIOP protocol handlers across all affected versions (10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0).
-
Restrict access to T3 and IIOP protocols. As an immediate mitigation while planning the patch, block external access to the T3 and IIOP protocols on WebLogic Server. Configure network firewalls and WebLogic connection filters to allow T3 and IIOP connections only from trusted internal management hosts. These protocols should never be exposed to the internet.
-
Upgrade to a supported WebLogic Server version. WebLogic Server 10.3.6.0.0 has reached end of extended support. Migrate to a currently supported version (14.1.1.0.0 or later) that receives regular security updates. Running end-of-life software increases the risk of unpatched vulnerabilities accumulating over time.
-
Conduct a thorough compromise assessment. If the WebLogic Server was exposed with T3 or IIOP protocols accessible from untrusted networks, assume compromise until proven otherwise. Review server logs for unusual deserialization errors, check for deployed web shells or unauthorized applications, inspect outbound network connections for command-and-control traffic, and verify the integrity of all deployed applications.
-
Implement deserialization filtering as defense-in-depth. Enable WebLogic Server's built-in deserialization filtering (JEP 290 or WebLogic's native filter) to restrict the classes that can be deserialized through T3 and IIOP. This provides an additional layer of protection against future deserialization vulnerabilities even after patching.
Technical Details
CVE-2020-2883 carries a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, resulting in a critical base score of 9.8. This vector represents the most dangerous attack profile possible under the unchanged scope model: the vulnerability is exploitable remotely over the network (AV:N), requires no special conditions or race windows (AC:L), needs no authentication or privileges (PR:N), and requires no user interaction (UI:N).
The vulnerability resides in Oracle WebLogic Server's Core component, specifically in how it handles deserialization of Java objects received through the T3 and IIOP network protocols. T3 is Oracle's proprietary protocol used for communication between WebLogic Server instances and Java clients, while IIOP (Internet Inter-ORB Protocol) is used for CORBA-based interoperability. Both protocols accept serialized Java objects from remote clients as part of their normal operation.
The attack mechanism leverages Java deserialization gadget chains present in libraries available on the WebLogic Server classpath. An attacker constructs a specially crafted serialized Java object that, when deserialized by the server, triggers a sequence of method calls across multiple Java classes. This chain ultimately results in the execution of arbitrary operating system commands or Java code with the full privileges of the WebLogic Server process. The specific gadget chains exploited by CVE-2020-2883 bypass previous deserialization blacklists that Oracle had implemented in response to earlier WebLogic deserialization vulnerabilities (such as CVE-2019-2725 and CVE-2020-2555), indicating that the attacker community continues to discover new viable gadget chains in the WebLogic environment. The affected versions span multiple major release lines: 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0.
Frequently Asked Questions
What is CVE-2020-2883?
CVE-2020-2883 is a critical remote code execution vulnerability in Oracle WebLogic Server that allows an unauthenticated attacker to take over the server by sending malicious serialized Java objects via the T3 or IIOP protocols. It has a CVSS v3.1 score of 9.8 and public exploit code is readily available.
Which versions of WebLogic Server are affected by CVE-2020-2883?
The affected versions are Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0. Oracle released patches for all these versions in the April 2020 Critical Patch Update. Organizations should upgrade to the latest patched version on their respective branch.
Can CVE-2020-2883 be exploited without authentication?
Yes. This is one of the most dangerous aspects of CVE-2020-2883. The vulnerability requires no authentication, no user interaction, and no special privileges. Any attacker who can reach the T3 or IIOP ports of a vulnerable WebLogic Server can exploit this vulnerability to execute arbitrary code.
How can I mitigate CVE-2020-2883 if I cannot patch immediately?
The most effective interim mitigation is to block external access to T3 and IIOP protocols using network firewalls and WebLogic connection filters. These protocols typically run on the same port as HTTP (default 7001) but use different protocol headers. WebLogic connection filters can be configured to restrict T3/IIOP access to specific trusted IP addresses while still allowing HTTP traffic.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.