Oracle · WebLogic Server
CVE-2020-14883
Oracle WebLogic Server Unspecified Vulnerability
Nedir
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CISA: Oracle WebLogic Server contains an unspecified vulnerability in the Console component with high impacts to confidentilaity, integrity, and availability.
Ne yapmalı
Apply updates per vendor instructions.
ABD federal kurumları için son tarih: 3 Mayıs 2022
Oracle için istismar edilen diğer açıklar
| Eklenme | Açık | Ürün | Önem | Saldırı olasılığı |
|---|---|---|---|---|
| 1 Haz 2026 | Unspecified | WebLogic Server | Yüksek 7,5 | 74% |
| 7 Oca 2025 | Unspecified | WebLogic Server | Kritik 9,8 | 95% |
| 18 Eyl 2024 | Remote Code Execution | WebLogic Server | Kritik 9,8 | 95% |
| 3 Haz 2024 | OS Command Injection | WebLogic Server | Yüksek 7,4 | 96% |
| 1 May 2023 | Unspecified | WebLogic Server | Yüksek 7,5 | 99,9% |
| 8 Eyl 2022 | Unspecified | WebLogic Server | Kritik 9,8 | >99,9% |
| 10 Şub 2022 | Corporation WebLogic Server Remote Code Execution | WebLogic Server | Yüksek 7,5 | >99,9% |
| 10 Oca 2022 | WebLogic Server, Injection | WebLogic Server | Yüksek 7,5 | >99,9% |
Kaynaklar: Known Exploited Vulnerabilities (CISA, kamu malı), CVE records (cve.org) ve EPSS (FIRST). Saldırı olasılığı, birinin önümüzdeki 30 günde açığı istismar etmeye çalışacağına dair EPSS tahminidir.