CVE-2020-2883

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Oracle Corporation	WebLogic Server	10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0

References

http://packetstormsecurity.com/files/157950/WebLogic-Server-Deserialization-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
https://www.oracle.com/security-alerts/cpuapr2020.htmlVendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-504/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-20-570/Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/157950/WebLogic-Server-Deserialization-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
https://www.oracle.com/security-alerts/cpuapr2020.htmlVendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-504/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-20-570/Third Party Advisory, VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-2883US Government Resource

Timeline

Published: Apr 15, 2020
Last modified: Jun 17, 2026
Added to CISA KEV: Jan 7, 2025
NVD status: Analyzed

Related CVEs from 2020

CVE-2020-288383.5Cross Site Request Forgery (CSRF) in CART option in OpenCart Ltd. Opencart CMS 3.0.3.6 allows attacker to add cart items via Add to cart.CVE-2020-28849.8Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are CVE-2020-288407.8Buffer Overflow vulnerability in jpgfile.c in Matthias-Wandel jhead version 3.04, allows local attackers to execute arbitrary code and cause CVE-2020-288415.5MyDrivers64.sys in DriverGenius 9.61.3708.3054 allows attackers to cause a system crash via the ioctl command 0x9c402000 to \\.\MyDrivers0_0 CVE-2020-288457.8A CSV injection vulnerability in the Admin portal for Netskope 75.0 allows an unauthenticated user to inject malicious payload in admin's po CVE-2020-288466.5Cross Site Request Forgery (CSRF) vulnerability exists in SeaCMS 10.7 in admin_manager.php, which could let a malicious user add an admin ac CVE-2020-288475.4Cross Site Scripting (XSS) vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment.CVE-2020-288488.8CSV Injection vulnerability in ChurchCRM version 4.2.0, allows remote attackers to execute arbitrary code via crafted CSV file.CVE-2020-288495.4Cross Site Scripting (XSS) vulnerability in ChurchCRM version 4.2.1, allows remote attckers to execute arbitrary code and gain sensitive inf CVE-2020-28858.2Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments). Supported ver CVE-2020-288517.5In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. (x/text/langua CVE-2020-288527.5In x/text in Go before v0.3.5, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while processing a BCP 47 tag. (x/