What’s Vulnerable › Vulnerabilities

CVE-2020-14883: Oracle WebLogic Server Unspecified Vulnerability

Description

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Summary

CVE-2020-14883 is an easily exploitable flaw in the Console component of Oracle WebLogic Server that lets a high-privileged attacker with HTTP network access take over the server, with high impact on confidentiality, integrity and availability. Affected versions are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, a public exploit exists, and EPSS gives a 97.7% probability of exploitation within 30 days. Apply the updates specified in Oracle's vendor instructions as soon as possible.

CVE-2020-14883 ثغرة سهلة الاستغلال في مكوّن Console ضمن Oracle WebLogic Server، تتيح لمهاجم يتمتع بصلاحيات عالية ووصول شبكي عبر HTTP السيطرة الكاملة على الخادم، مع تأثير كبير على السرية والسلامة والتوافر. الإصدارات المتأثرة هي 10.3.6.0.0 و12.1.3.0.0 و12.2.1.3.0 و12.2.1.4.0 و14.1.1.0.0. الثغرة مدرجة في كتالوج CISA للثغرات المعروفة بالاستغلال مع استغلال نشط، ويتوفر استغلال عام، وتبلغ احتمالية الاستغلال خلال 30 يوماً وفق EPSS نسبة 97.7%. يجب تطبيق التحديثات وفق تعليمات المورّد في أقرب وقت ممكن.

Affected products

References

Get alerted when CVE-2020-14883 or the next vulnerability affects your stack