CVE-2020-14750: critical vulnerability in Oracle Corporation WebLogic Server
Published · Updated
100Vexday Risk Score
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
ssvc Actcvss 9.8epss 99%
from disclosure to weapon0 days
Published on NVDNov 1
1st PoCJan 15
metasploitOct 20
CISA KEV+367d
exploitation probability
99%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
7 public exploit(s)
Action required by CISAfederal deadline: 2022-05-03
Apply updates per vendor instructions.
In short
A critical vulnerability in Oracle WebLogic Server allows attackers to take complete control of the server without authentication. An attacker can send a malicious HTTP request over the network to gain full access to the system.
Technical detail
Unauthenticated remote code execution vulnerability in Oracle WebLogic Server Console component affecting versions 10.3.6.0.0 through 14.1.1.0.0. Attack vector is network-based HTTP with no authentication required and minimal complexity; successful exploitation results in complete system compromise including confidentiality, integrity, and availability impacts (CVSS 3.1: 9.8).
Summary generated and translated by AI from the official description.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).