## https://sploitus.com/exploit?id=790682BD-6590-569F-BBBA-30AF828DF77B
CVE-2020-2555 is a remote code execution (RCE) vulnerability in Oracle WebLogic Server. It is caused by a deserialization bug in the com.tangosol.util.extractor.ReflectionExtractor class. The vulnerability allows an attacker to execute arbitrary code on the server by sending a specially crafted request.
The vulnerability is present in WebLogic Server versions 12.2.1.0.0, 12.2.1.1.0, 12.2.1.2.0, and 12.2.1.3.0. It is not present in versions 12.2.1.4.0 and later.
To exploit the vulnerability, an attacker needs to send a request to the server with a specially crafted payload. The payload should be a serialized object that contains a malicious ReflectionExtractor instance. When the server deserializes the object, it will execute the malicious code.
The vulnerability was discovered by a researcher who found that the ReflectionExtractor class does not properly validate user input. This allows an attacker to inject malicious code into the server.
To fix the vulnerability, Oracle released a patch for WebLogic Server versions 12.2.1.0.0, 12.2.1.1.0, 12