| Vulnerability Name: | CVE-2020-14883 (CCN-190200) | ||||||||||||
| Assigned: | 2020-10-20 | ||||||||||||
| Published: | 2020-10-20 | ||||||||||||
| Updated: | 2022-07-12 | ||||||||||||
| Summary: | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). | ||||||||||||
| CVSS v3 Severity: | 7.2 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) 6.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C)
6.7 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C)
| ||||||||||||
| CVSS v2 Severity: | 9.0 High (CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C)
| ||||||||||||
| Vulnerability Type: | CWE-Other | ||||||||||||
| Vulnerability Consequences: | Other | ||||||||||||
| References: | Source: MITRE Type: CNA CVE-2020-14883 Source: MISC Type: Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/160143/Oracle-WebLogic-Server-Administration-Console-Handle-Remote-Code-Execution.html Source: XF Type: UNKNOWN oracle-cpuoct2020-cve202014883(190200) Source: CCN Type: metasploit-framework GIT Repository metasploit-framework/weblogic_admin_handle_rce.rb at master · rapid7/metasploit-framework · GitHub Source: CCN Type: Rapid7 Vulnerability & Exploit Database Oracle WebLogic Server Administration Console Handle RCE Source: CCN Type: Packet Storm Security [11-19-2020] Oracle WebLogic Server Administration Console Handle Remote Code Execution Source: CCN Type: CYBERSECURITY & INFRASTRUCTURE SECURITY AGENCY KNOWN EXPLOITED VULNERABILITIES CATALOG Source: CCN Type: Oracle CPUOct2020 Oracle Critical Patch Update Advisory - October 2020 Source: MISC Type: Vendor Advisory https://www.oracle.com/security-alerts/cpuoct2020.html Source: CCN Type: Rapid7 Vulnerability & Exploit Database Oracle WebLogic Server Administration Console Handle RCE | ||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||
| BACK | |||||||||||||