CVE-2020-2883

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2020-2883 is a vulnerability in the Core component of Oracle WebLogic Server within Oracle Fusion Middleware. It affects supported versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0. The flaw is reachable over the network through IIOP or T3 protocols and carries a CVSS 3.1 base score of 9.8 with full impacts to confidentiality, integrity, and availability.

An unauthenticated attacker with network access can exploit the issue to achieve remote takeover of the WebLogic Server instance. No user interaction or credentials are required, making the attack surface broad for any exposed server.

Oracle's April 2020 Critical Patch Update addresses the vulnerability, and separate Zero Day Initiative advisories (ZDI-20-504 and ZDI-20-570) provide additional technical detail on the flaw. Public exploit artifacts referencing deserialization remote code execution have also been posted to Packet Storm.

The combination of an unauthenticated network vector, critical severity, and readily available proof-of-concept material indicates the issue is of immediate concern for organizations running the listed WebLogic versions.