CVE DatabaseCVE-2023-21839

Updated 2026-06-17한국어 권고문 →

CVE-2023-218397.5/HIGHCISA KEVCWE-502CWE-306

Oracle WebLogic Server T3/IIOP Protocol Unauthenticated Information Disclosure and RCE Vulnerability (CVE-2023-21839) Security Advisory

⚡ Jump to Patch

Affected Vendors

oracle

Affected Components

weblogic_server

Published Date

2023-01-18

CVSS v3.1

7.5

HIGH

EPSS (30d)

99.9%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Oracle WebLogic Server versions 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0

Impact

Unauthenticated remote attackers can compromise the server via T3/IIOP protocols, leading to unauthorized access to sensitive data or potential Remote Code Execution (RCE)

Mitigation

Apply the official Oracle Critical Patch Update (CPU) or restrict external access to T3/IIOP protocols (typically port 7001)

Affected Products & Version Scope

Oracle WebLogic Server: 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Download the appropriate patch from the Oracle Security Alert portal and apply it using the OPatch utility.

bash

# Set environment variables and verify current patch level
export ORACLE_HOME='/u01/app/oracle/middleware'
export PATH=$ORACLE_HOME/OPatch:$PATH
opatch lsinventory

# Apply the downloaded Oracle CPU patch
cd /u01/patches/34883826
opatch apply

2. Temporary Workaround & Hardening Configuration

If patching cannot be applied immediately, configure Connection Filters in the WebLogic Admin Console to block external T3/IIOP traffic.

text

# WebLogic Connection Filter Rules (Admin Console -> Domain -> Security -> Filter)
# Allow T3/T3S only from trusted admin IP (e.g., 192.168.1.100) and deny all others
192.168.1.100 * * allow t3 t3s
0.0.0.0/0 * * deny t3 t3s

3. Log Audit & IoC Verification Commands

Inspect WebLogic server logs for unauthorized outbound JNDI lookup attempts and verify port exposure.

bash

# Scan WebLogic logs for suspicious outbound LDAP or RMI connection attempts
grep -Ei 'ldap://|rmi://' /u01/app/oracle/domains/base_domain/servers/*/logs/*.log

# Check if T3/IIOP ports are exposed to the public internet
netstat -an | grep 7001

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

As this vulnerability is actively exploited in the wild (CISA KEV), immediately apply the Oracle CPU patches or restrict T3/IIOP protocol access.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability exists in the Core component of Oracle WebLogic Server. It is caused by improper input validation and unsafe deserialization during the handling of T3 and IIOP protocol communications (CWE-502, CWE-306). Due to the lack of proper authentication checks, an attacker can abuse JNDI (Java Naming and Directory Interface) binding mechanisms to force the WebLogic server to connect to an external, attacker-controlled directory service.

2. Exploitation Mechanics & Attack Scenario

An unauthenticated attacker with network access to the WebLogic Server's T3/IIOP port (default 7001) sends a specially crafted serialized object. This object leverages classes like ForeignOpaqueReference to trigger a JNDI lookup. When the WebLogic server deserializes the object and resolves the reference, it initiates an outbound connection to an attacker-controlled LDAP or RMI server. This allows the attacker to retrieve sensitive environment variables, database credentials, or load malicious Java classes to execute arbitrary commands.

3. Infrastructure & Business Impact

With a CVSS score of 7.5 and active exploitation confirmed by its inclusion in the CISA KEV catalog, this vulnerability poses a severe threat to enterprise infrastructure. Successful exploitation can lead to complete exposure of sensitive application data, database credentials, and configuration files. Furthermore, it can serve as an entry point for lateral movement within the internal network, potentially leading to full domain compromise.

Official Vendor Advisories & References

NVD Original English Description

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

http://packetstormsecurity.com/files/172882/Oracle-Weblogic-PreAuth-Remote-Command-Execution.html

Source: secalert_us@oracle.com · Exploit, Third Party Advisory, VDB Entry

https://www.oracle.com/security-alerts/cpujan2023.html

Source: secalert_us@oracle.com · Patch, Vendor Advisory

http://packetstormsecurity.com/files/172882/Oracle-Weblogic-PreAuth-Remote-Command-Execution.html

Source: af854a3a-2127-422b-91ae-364da2661108 · Exploit, Third Party Advisory, VDB Entry

https://www.oracle.com/security-alerts/cpujan2023.html

Source: af854a3a-2127-422b-91ae-364da2661108 · Patch, Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21839

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2023-21839)

FAQ

Q1. How critical is CVE-2023-21839 and is it actively exploited in the wild?

CVE-2023-21839 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 99.9%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2023-21839?

Primary impacted vendors include oracle across weblogic_server. Scope summary: Oracle WebLogic Server: 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0

Q3. What temporary mitigations or workarounds exist for CVE-2023-21839 before patching?

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict external access to T3/IIOP protocols (typically port 7001) Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION