# MA-759.012020: MyCERT Alert - Increasing Attempts of Oracle WebLogic Server Vulnerability [CVE-2018-2894]

**Date:** 13 Jan 2020  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-759.012020  
**Advisory ID:** MA-759.012020

---

**1.0 Introduction**
MyCERT received information from valid resources regarding to increasing attacks on vulnerability in Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS – Web Services). This exploit will allow unauthenticated attackers to compromise WebLogic under network access via HTTP protocol.
**2.0 Impact**
Every successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.
**3.0 Affected System and Devices**
Oracle WebLogic Server version:
- 12.1.3.0
- 12.2.1.2
- 12.2.1.3
**4.0 Recommendations**
Oracle has released an update to apply critical patch update as soon as possible. <https://www.oracle.com/middleware/technologies/weblogic-server-installers-downloads.html>
Until patch is being applied, you may reduce the risk of successful attack by doing the followings:
- Blocking network protocols required by an attack.
- For attacks that require certain privileges or access to certain packages, removing the privileges or the ability to access the packages from users that do not need the privileges may help reduce the risk of successful attack.
- Both approaches may break application functionality, so Oracle strongly recommends that customers test changes on non-production systems.
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 - 8008 7000 (Office Hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: <https://twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2894>
- <https://github.com/jas502n/CVE-2018-2894>
- <https://www.oracle.com/security-alerts/cpujul2018.html>
- <https://www.oracle.com/middleware/technologies/weblogic-server-installers-downloads.html>