Using Whitelisting to Remediate an RCE Vulnerability (CVE-2019-2729) in Oracle WebLogic[html]
https://blog.trendmicro.com/trendlabs-security-intelligence/files/2019/03/Vulnerability-380x380.jpg 380w,
https://blog.trendmicro.com/trendlabs-security-intelligence/files/2019/03/Vulnerability.jpg 400w" sizes="(max-width: 200px) 100vw, 200px" />
Oracle WebLogic has recently disclosed and patched remote-code-execution (RCE) vulnerabilities in its software, many of which were due to insecure deserialization. Oracle addressed the most recent vulnerability, CVE-2019-2729, in an out-of-band security patch on June 18, 2019. CVE-2019-2729 was assigned a CVSS score of 9.8, making it a critical vulnerability. This vulnerability is relatively easily exploitable, but requires Java Development Kit (JDK) 1.6. By default, WebLogic version 10.3.6 is shipped with JDK 1.6.
CVE-2019-2729 is essentially a bypass to CVE-2019-2725. This security issue, however, first surfaced in April 24 2017 as CVE-2017-3506.
