| Vulnerability Name: | CVE-2020-14882 (CCN-190199) | ||||||||||||
| Assigned: | 2020-10-20 | ||||||||||||
| Published: | 2020-10-20 | ||||||||||||
| Updated: | 2022-07-12 | ||||||||||||
| Summary: | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). | ||||||||||||
| CVSS v3 Severity: | 9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) 9.1 Critical (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C)
9.1 Critical (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C)
| ||||||||||||
| CVSS v2 Severity: | 10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
| ||||||||||||
| Vulnerability Type: | CWE-Other | ||||||||||||
| Vulnerability Consequences: | Other | ||||||||||||
| References: | Source: MITRE Type: CNA CVE-2020-14882 Source: MISC Type: Exploit, Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/159769/Oracle-WebLogic-Server-Remote-Code-Execution.html Source: MISC Type: Exploit, Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/160143/Oracle-WebLogic-Server-Administration-Console-Handle-Remote-Code-Execution.html Source: MISC Type: Exploit, Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/161128/Oracle-WebLogic-Server-12.2.1.0-Remote-Code-Execution.html Source: XF Type: UNKNOWN oracle-cpuoct2020-cve202014882(190199) Source: CCN Type: metasploit-framework GIT Repository metasploit-framework/weblogic_admin_handle_rce.rb at master · rapid7/metasploit-framework · GitHub Source: CCN Type: Packet Storm Security [10-29-2020] Oracle WebLogic Server Remote Code Execution Source: CCN Type: Packet Storm Security [11-19-2020] Oracle WebLogic Server Administration Console Handle Remote Code Execution Source: CCN Type: Packet Storm Security [01-26-2021] Oracle WebLogic Server 12.2.1.0 Remote Code Execution Source: CCN Type: CYBERSECURITY & INFRASTRUCTURE SECURITY AGENCY KNOWN EXPLOITED VULNERABILITIES CATALOG Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [10-29-2020] Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [01-26-2021] Source: CCN Type: Oracle CPUOct2020 Oracle Critical Patch Update Advisory - October 2020 Source: MISC Type: Vendor Advisory https://www.oracle.com/security-alerts/cpuoct2020.html Source: CCN Type: Rapid7 Vulnerability & Exploit Database Oracle WebLogic Server Administration Console Handle RCE | ||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||
| BACK | |||||||||||||