Description
The Oracle WebLogic WLS-WSAT Component (versions 12.2.1.2.0 and prior) is vulnerable to a XML Deserialization remote code execution vulnerability. Malicious input passed to the XMLDecoder constructor and read functions within the WorkContextXmlInputAdapter class result in the deserialization of an arbitrary Java serialized object. Unauthenticated attackers can exploit it to remotely execute arbitrary code.
Remediation
Oracle released a Critical Patch Update that fixes this issue. To fix this vulnerability it's recommended to install the Oracle Critical Patch Update from the References section.
References
Related Vulnerabilities
ManageEngine Desktop Central Deserialization RCE (CVE-2020-10189)
Grav CMS Unauthenticated RCE (CVE-2021-21425)
XWiki Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2020-11057)
WordPress Plugin WordPress Mega Menu-QuadMenu Remote Code Execution (2.0.6)
Oracle Sun GlassFish/Java System Application Server Remote Authentication Bypass Vulnerability