Oracle · WebLogic Server
CVE-2020-14750
Oracle WebLogic Server Remote Code Execution Vulnerability
Nedir
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CISA: Oracle WebLogic Server contains an unspecified vulnerability allowing an unauthenticated attacker to perform remote code execution. This vulnerability is related to CVE-2020-14882.
Ne yapmalı
Apply updates per vendor instructions.
ABD federal kurumları için son tarih: 3 Mayıs 2022
Oracle için istismar edilen diğer açıklar
| Eklenme | Açık | Ürün | Önem | Saldırı olasılığı |
|---|---|---|---|---|
| 1 Haz 2026 | Unspecified | WebLogic Server | Yüksek 7,5 | 74% |
| 7 Oca 2025 | Unspecified | WebLogic Server | Kritik 9,8 | 95% |
| 18 Eyl 2024 | Remote Code Execution | WebLogic Server | Kritik 9,8 | 95% |
| 3 Haz 2024 | OS Command Injection | WebLogic Server | Yüksek 7,4 | 96% |
| 1 May 2023 | Unspecified | WebLogic Server | Yüksek 7,5 | 99,9% |
| 8 Eyl 2022 | Unspecified | WebLogic Server | Kritik 9,8 | >99,9% |
| 10 Şub 2022 | Corporation WebLogic Server Remote Code Execution | WebLogic Server | Yüksek 7,5 | >99,9% |
| 10 Oca 2022 | WebLogic Server, Injection | WebLogic Server | Yüksek 7,5 | >99,9% |
Kaynaklar: Known Exploited Vulnerabilities (CISA, kamu malı), CVE records (cve.org) ve EPSS (FIRST). Saldırı olasılığı, birinin önümüzdeki 30 günde açığı istismar etmeye çalışacağına dair EPSS tahminidir.