Oracle WebLogic Server Unspecified
CVE-2020-14883 is a high-severity vulnerability in WebLogic Server from Oracle, with a CVSS 2.0 base score of 9.0 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, without any action from a user. Affected WebLogic Server versions: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0, and others listed below. The record does not name a fixed version, so check the vendor advisory. CISA added it to the Known Exploited Vulnerabilities catalogue on November 3, 2021, which means attacks have been observed in the wild.
Attackers are already exploiting this vulnerability, according to CISA.
What to do
- Check which version of WebLogic Server you run against the affected versions below, and install the vendor's latest release.
- CISA's required action: Apply updates per vendor instructions.
- Read the advisory on oracle.com for workarounds and exact fixed builds.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Oracle | WebLogic Server | 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0 | Not stated |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Access vector
- NetworkCan be exploited remotely over a network.
- Access complexity
- LowNo special conditions are needed.
- Authentication
- SingleOne login is needed.
- Confidentiality
- CompleteAll data can be read.
- Integrity
- CompleteAny data can be modified.
- Availability
- CompleteThe system can be shut down completely.
Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 7.2 | High | CNA (oracle.com) |
| CVSS 2.0 | 9.0 | High | NVD |
Official description
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
Timeline
- CVE record published.
- Added to CISA's Known Exploited Vulnerabilities catalogue.
- Deadline for US federal agencies to remediate, set by CISA.
- CISA published its SSVC assessment (exploitation: active, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Third-party and government advisories
- packetstormsecurity.com/files/160143/Oracle-WebLogic-Server-Administration-Console-Handle-Remote-Code-Executi…Third Party Advisory, VDB Entry
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-14883US Government Resource
Other vulnerabilities in WebLogic Server
- 7.3 High severity
- 9.8 Critical severity
- 9.1 Critical severity
- 9.8 Critical severity
- 9.9 Critical severity
- 10.0 Critical severity
Spotted an error? Tell us.