Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2019-2725

Quick assessment

Affected

Oracle Corporation Tape Library ACSLS

Exploitation

Confirmed exploitation in the wild; remediate immediately

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Oracle Fusion Middleware（Oracle融合中间件）是美国甲骨文（Oracle）公司的一套面向企业和云环境的业务创新平台。该平台提供了中间件、软件集合等功能。WebLogic Server是其中的一个适用于云环境和传统环境的应用服务器组件。部分版本WebLogic中默认包含的wls9_async_response包，为WebLogicServer提供异步通讯服务。由于该WAR包在反序列化处理输入信息时存在缺陷，攻击者可以发送精心构造的恶意HTTP请求，获得目标服务器的权限，在未授权

AI Predicted 9.8 Difficulty: Trivial KEV · Ransomware EPSS 99.96% · P100 Updated Oct 02, 2026

Public Exploits 4

ExploitDB · 2 EDB-46814 [remote] EDB-46780 [webapps]

Metasploit · 1 weblogic_deserialize_asyncresponseservice.rb [exploit]

Nuclei · 1 CVE-2019-2725.yaml [template]

In-the-Wild Activity Observed cisa_kev · confirmed

Possible ATT&CK Techniques 3 AI

T1059.004 · Unix Shell T1078 · Valid Accounts T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Oracle Corporation	Tape Library ACSLS	`8.5`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2019-2725

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

N/A

Source: CVE Program / CVE List V5

Vulnerability Description

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Vulnerability Title

Oracle Fusion Middleware WebLogic Server组件访问控制错误漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Shenlong Deep Dive — AI Deep Analysis

10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.

Read summary Full analysis (login)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Oracle Corporation	Tape Library ACSLS	8.5	-

II. Public POCs for CVE-2019-2725

#	POC Description	Source Link	Shenlong Link
1	None	https://github.com/iceMatcha/CNTA-2019-0014xCVE-2019-2725	POC Details
2	None	https://github.com/lasensio/cve-2019-2725	POC Details
3	None	https://github.com/davidmthomsen/CVE-2019-2725	POC Details
4	None	https://github.com/leerina/CVE-2019-2725	POC Details
5	None	https://github.com/zhusx110/cve-2019-2725	POC Details
6	CVE-2019-2725 命令回显	https://github.com/lufeirider/CVE-2019-2725	POC Details
7	CVE-2019-2725命令回显+webshell上传+最新绕过	https://github.com/TopScrew/CVE-2019-2725	POC Details
8	None	https://github.com/welove88888/CVE-2019-2725	POC Details
9	weblogic绕过和wls远程执行	https://github.com/jiansiting/CVE-2019-2725	POC Details
10	CVE-2019-2725 bypass pocscan and exp	https://github.com/kerlingcode/CVE-2019-2725	POC Details
11	Weblogic CVE-2019-2725 CVE-2019-2729 Getshell 命令执行	https://github.com/black-mirror/Weblogic	POC Details
12	WebLogic Insecure Deserialization - CVE-2019-2725 payload builder & exploit	https://github.com/pimps/CVE-2019-2725	POC Details
13	CVE-2019-2725	https://github.com/ianxtianxt/CVE-2019-2725	POC Details
14	CVE-2019-2725-POC	https://github.com/N0b1e6/CVE-2019-2725-POC	POC Details
15	weblogic CVE-2019-2725利用exp。	https://github.com/GGyao/weblogic_2019_2725_wls_batch	POC Details
16	(CVE-2019-2725) Oracle WLS(Weblogic) RCE test sciript	https://github.com/ludy-dev/Oracle-WLS-Weblogic-RCE	POC Details
17	None	https://github.com/1stPeak/CVE-2019-2725-environment	POC Details
18	A simple exploit for CVE-2019-2725.	https://github.com/CalegariMindSec/Exploit-CVE-2019-2725	POC Details
19	None	https://github.com/Kamiya767/CVE-2019-2725	POC Details
20	None	https://github.com/tobechenghuai/CNTA-2019-0014xCVE-2019-2725	POC Details
21	The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services) allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. Versions that are affected are 10.3.6.0.0 and 12.1.3.0.0.	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-2725.yaml	POC Details
22	None	https://github.com/Threekiii/Awesome-POC/blob/master/%E4%B8%AD%E9%97%B4%E4%BB%B6%E6%BC%8F%E6%B4%9E/Weblogic%20XMLDecoder%20%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%20CVE-2019-2725.md	POC Details
23	Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.	https://github.com/loursha/Oracle-Weblogic-Server-AsyncResponseService-Deserialization-Remote-Code-Execution-CVE-2019-2725	POC Details

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2019-2725

请登录查看更多情报信息。

Vendor Advisories for CVE-2019-2725 (6)

http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html x_refsource_MISC
https://www.oracle.com/security-alerts/alert-cve-2019-2725.html#AppendixFMW x_refsource_MISC
https://support.f5.com/csp/article/K90059138 x_refsource_CONFIRM
http://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html x_refsource_MISC
https://www.oracle.com/security-alerts/cpujan2020.html x_refsource_MISC
http://www.securityfocus.com/bid/108074 vdb-entry x_refsource_BID

Exploits & Public PoCs for CVE-2019-2725 (2)

Packet Storm x_refsource_MISC
https://www.exploit-db.com/exploits/46780/ exploit x_refsource_EXPLOIT-DB

https://www.cve.org/CVERecord?id=CVE-2019-2725

IV. Related Vulnerabilities

Same vendor: Oracle Corporation

V. Comments for CVE-2019-2725

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2019-2725

Quick assessment

Public Exploits 4

Possible ATT&CK Techniques 3 AI

Affected Version Matrix 1

I. Basic Information for CVE-2019-2725

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Shenlong Deep Dive — AI Deep Analysis

Affected Products

II. Public POCs for CVE-2019-2725

III. Intelligence Information for CVE-2019-2725

Vendor Advisories for CVE-2019-2725 (6)

Exploits & Public PoCs for CVE-2019-2725 (2)

IV. Related Vulnerabilities

V. Comments for CVE-2019-2725

Leave a comment