CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Oracle WebLogic Server T3/IIOP Protocol Unauthenticated Information Disclosure and RCE Vulnerability (CVE-2023-21839) Security Advisory
[Affected Scope] Oracle WebLogic Server versions 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0
[Impact] Unauthenticated remote attackers can compromise the server via T3/IIOP protocols, leading to unauthorized access to sensitive data or potential Remote Code Execution (RCE)
[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict external access to T3/IIOP protocols (typically port 7001)
Oracle WebLogic Server T3/IIOP Protocol Deserialization Remote Code Execution (RCE) Vulnerability (CVE-2020-2883) Analysis and Mitigation Guide
[Affected Scope] Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0
[Impact] Unauthenticated remote attackers can execute arbitrary code and take full control of the Oracle WebLogic Server by sending malicious serialized data via T3 or IIOP protocols
[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately, or restrict external access to T3/IIOP protocols using connection filters and firewalls
Oracle WebLogic Server IIOP Deserialization Remote Code Execution Vulnerability (CVE-2020-2551) Analysis and Mitigation Guide
[Affected Scope] Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0
[Impact] Unauthenticated remote attackers can execute arbitrary code and fully compromise the WebLogic Server via malicious IIOP requests
[Mitigation] Apply the official Oracle CPU patches immediately, or disable the IIOP protocol and restrict access to port 7001