CVE-2014-4210: Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0 and 10.3.6.0 allows remote attackers to affect…

PriorityP345medium5CVSS 2.0

AVNACLAuNCPINAN

EXPLOIT

EPSS

38.15%

98.6th percentile

Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0 and 10.3.6.0 allows remote attackers to affect confidentiality via vectors related to WLS - Web Services.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
oracle	fusion_middleware	—	—
oracle	fusion_middleware	—	—

Detection & IOCsextracted from sources · hover to see the quote

path/uddiexplorer/SearchPublicRegistries.jsp↗

url/uddiexplorer/SearchPublicRegistries.jsp?rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search&operator=http://{{interactsh-url}}↗

→Monitor for unauthenticated GET requests to /uddiexplorer/SearchPublicRegistries.jsp with an attacker-controlled 'operator' parameter, which is the SSRF injection point for CVE-2014-4210. ↗
→Detect exploitation attempts by inspecting the HTTP response body for the string 'Search public registries' combined with an out-of-band HTTP callback (OAST/interactsh), confirming the SSRF triggered an outbound connection. ↗
→Use Shodan/FOFA queries to identify exposed Oracle WebLogic servers as potential targets: search for title 'Weblogic', http.title 'weblogic', or http.html 'weblogic application server'. ↗
→GreyNoise tagged active scanning/exploitation attempts for this CVE as 'Oracle WebLogic CVE-2014-4210 SSRF Attempt' starting November 2023, indicating ongoing mass exploitation activity nearly a decade after disclosure. ↗
→The SSRF allows probing arbitrary internal TCP ports; responses are verbose enough to infer whether a service is listening, enabling internal network port scanning via the 'operator' parameter. ↗

·Vulnerability affects only Oracle Fusion Middleware versions 10.0.2.0 and 10.3.6.0; detection rules should be scoped to these versions to reduce false positives. ↗
·The SSRF is exploitable without authentication; no session cookie or credential is required, meaning perimeter controls alone are insufficient if the UDDI endpoint is reachable. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.