CVE-2020-14841

published 2020-10-21

CVE-2020-14841: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0…

Priority P2 79 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected

10 ranges

Vendor	Product	Version range	Fixed in
oracle	weblogic_server	—	—
oracle	weblogic_server	—	—
oracle	weblogic_server	—	—
oracle	weblogic_server	—	—
oracle	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—

Detection & IOCs extracted from sources · hover to see the quote

port IIOP (default TCP 7001/7002)

snort↗

alert tcp any any -> any any (msg:"ET EXPLOIT Oracle WebLogic IIOP JNDI Injection (CVE-2020-14841)"; flow:established,to_server; content:"corbaloc|3a|iiop|3a|"; nocase; fast_pattern; pcre:"/^[a-zA-Z0-9]{7,200}/R"; content:"idl|3a|weblogic/corba/cos/naming/namingcontextany"; nocase; reference:cve,2020-14841; classtype:attempted-admin; sid:2035013; rev:2; metadata:attack_target Server, created_at 2022_01_28, cve CVE_2020_14841, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, updated_at 2022_01_28, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)

bytes

corbaloc:iiop: (hex: corbaloc|3a|iiop|3a|)

bytes

idl:weblogic/corba/cos/naming/namingcontextany (hex: idl|3a|weblogic/corba/cos/naming/namingcontextany)

• → Exploit traffic targets Oracle WebLogic Server via the IIOP protocol. Monitor for inbound TCP connections carrying a CORBA IIOP JNDI injection payload — specifically a `corbaloc:iiop:` locator string followed by a WebLogic-specific IDL path (`idl:weblogic/corba/cos/naming/namingcontextany`). ↗
• → The exploit is unauthenticated and network-accessible — no prior authentication or user interaction is required. Any inbound IIOP connection to WebLogic from untrusted networks should be treated as high-risk. ↗
• → Successful exploitation results in full server takeover (C/I/A all HIGH). Treat any anomalous process spawned by the WebLogic JVM (e.g., shell, curl, wget) as a post-exploitation indicator. ↗
• → The Snort/Suricata rule (SID 2035013) uses a PCRE to match a 7–200 character alphanumeric string immediately following the `corbaloc:iiop:` prefix, which represents the injected JNDI lookup target. Tune detection on this pattern at the network perimeter and internally. ↗

• · Affected versions are tightly scoped. Ensure detection and patching efforts cover all five listed versions; deployments running any of these are vulnerable. ↗
• · The Snort rule is deployed for both Perimeter and Internal segments, indicating the threat model includes lateral movement via IIOP — not just external ingress. Internal IIOP traffic between WebLogic nodes should also be inspected. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

vendor_oracle 9.8 CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.