CVE Vulnerability Advisory Database

Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.

Showing 1–2 of 2 advisories (Page 1/1)

CVE-2020-147509.8/CRITICALEPSS 99.3%CISA KEV

2020-11-02

Oracle WebLogic Server Console Remote Code Execution and Authentication Bypass Vulnerability (CVE-2020-14750) Security Advisory

[Affected Scope] Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0

[Impact] Unauthenticated remote attackers with network access via HTTP can bypass authentication on the administration console and achieve full remote code execution (RCE)

[Mitigation] Immediately apply the official Oracle security patches and restrict network access to the WebLogic Administration Console (/console)

cve-2020-14750 weblogic rce auth-bypass cwe-287

Full Advisory & Mitigation

CVE-2020-25519.8/CRITICALEPSS 92.8%CISA KEV

2020-01-15

Oracle WebLogic Server IIOP Deserialization Remote Code Execution Vulnerability (CVE-2020-2551) Analysis and Mitigation Guide

[Affected Scope] Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0

[Impact] Unauthenticated remote attackers can execute arbitrary code and fully compromise the WebLogic Server via malicious IIOP requests

[Mitigation] Apply the official Oracle CPU patches immediately, or disable the IIOP protocol and restrict access to port 7001

cve-2020-2551 weblogic iiop rce deserialization cwe-502

Full Advisory & Mitigation