Security News > 2020 > May > Oracle Says Hackers Targeting Recently Patched Vulnerabilities

Oracle warned customers on Thursday that threat actors have been spotted attempting to exploit multiple recently patched vulnerabilities, including a critical WebLogic Server flaw tracked as CVE-2020-2883.

Oracle's April 2020 Critical Patch Update resolves nearly 400 vulnerabilities, including CVE-2020-2883, a critical flaw in Oracle WebLogic Server that can be exploited by an unauthenticated attacker for remote code execution.

Oracle has credited several people for independently reporting this vulnerability, including Bui Duong from Viettel Cyber Security, Jang of VNPT ISC, Kaki King, lufei from Qi An Xin Group, and Quynh Le of VNPT ISC. Quynh Le reported his findings to Oracle through Trend Micro's Zero Day Initiative, which recently published advisories describing two variants of CVE-2020-2883 identified by the researcher in February and March.

CVE-2020-2883 is one of the several WebLogic Server vulnerabilities for which a researcher claims to have published proof-of-concept code.

It's not uncommon for malicious actors to exploit Oracle WebLogic vulnerabilities in their attacks, in some cases even before a patch is released by Oracle.

News URL

http://feedproxy.google.com/~r/Securityweek/~3/A2quUqAB5mA/oracle-says-hackers-targeting-recently-patched-vulnerabilities