Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container)
Oracle Corporation · WebLogic Server
A flaw in the Web Container component of Oracle WebLogic Server, part of Oracle Fusion Middleware, affects the 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 releases. An unauthenticated attacker with network access over HTTP can gain unauthorized access to critical data, or to all data accessible to WebLogic Server, with no user interaction or special configuration required.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 7 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 6 days after disclosure.
- Disclosedday 0
- Public exploit codePoC-in-GitHub+6 days
- First seen exploitedVulnCheck KEV evidence+7 mo
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.