Description

Oracle WebLogic Server (part of Oracle Fusion Middleware) is vulnerable to a remote code execution vulnerability.

The following versions of Oracle WebLogic Server are affected: 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.

This easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.

Remediation

Upgrade to the latest version of Oracle WebLogic Server.

References

Oracle Critical Patch Update Advisory - October 2020

Related Vulnerabilities

WordPress Plugin Jekyll Exporter Remote Code Execution (2.2.0)

Ektron CMS unauthenticated code execution and Local File Read

WordPress Plugin Plainview Activity Monitor Remote Command Execution (20161228)

Code Evaluation (Ruby)

WordPress Plugin Flamingo Code Injection (1.1)

Severity

Critical

Classification

CVE-2020-14882 CWE-78 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Code Execution