⚠ Actively exploited
Added to CISA KEV on 2021-11-03. Federal agencies required to patch by 2022-05-03. Required action: Apply updates per vendor instructions..

CVE-2020-14882 — Corporation Weblogic Server vulnerability

77 documents18 sources
Severity
9.8CRITICALNVD
EPSS
94.5%
top < 0.01%
CISA KEV
KEV
Added 2021-11-03
Due 2022-05-03
Exploit
Exploited in wild
Active exploitation observed
Affected products
2
Oracle Corporation Weblogic ServerOracle Weblogic Server
Timeline
PublishedOct 21
KEV addedNov 3
KEV dueMay 3
Latest updateMar 30
CISA Required Action: Apply updates per vendor instructions.

Description

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability im…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDoracle/weblogic_server5 versions+4
▶CVEListV5oracle_corporation/weblogic_server5 versions+4

🔴Vulnerability Details

4
GHSA
GHSA-98w2-f859-jh76: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)↗2022-05-24
▶
CVEList
CVE-2020-14882: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)↗2020-10-21
▶
VulnCheck
Oracle WebLogic Server Remote Code Execution Vulnerability↗2020
▶
VulnCheck
Oracle WebLogic Server Remote Code Execution Vulnerability↗2020
▶

💥Exploits & PoCs

5
Exploit-DB
Oracle WebLogic Server 12.2.1.0 - RCE (Unauthenticated)↗2021-01-26
▶
Exploit-DB
WebLogic Server 10.3.6.0.0 / 12.1.3.0.0 / 12.2.1.3.0 / 12.2.1.4.0 / 14.1.1.0.0 - Unauthenticated RCE via GET request↗2020-10-29
▶
Nuclei
Oracle Weblogic Server - Remote Command Execution
▶
Nuclei
Oracle WebLogic Server - Remote Command Execution
▶
Metasploit
Oracle WebLogic Server Administration Console Handle RCE↗
▶

🔍Detection Rules

7
Suricata
ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Inbound M6 (CVE-2020-14882)↗2020-12-02
▶
Suricata
ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Inbound M5 (CVE-2020-14882)↗2020-11-06
▶
Suricata
ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Inbound M4 (CVE-2020-14882)↗2020-11-06
▶
Suricata
ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Inbound M3 (CVE-2020-14882)↗2020-11-06
▶
Suricata
ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Inbound M2 (CVE-2020-14882)↗2020-11-06
▶

📋Vendor Advisories

3
CISA
Oracle WebLogic Server Remote Code Execution Vulnerability↗2021-11-03
▶
CISA
Oracle WebLogic Server Remote Code Execution Vulnerability↗2021-11-03
▶
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Console — CVE-2020-14882↗2020-10-15
▶

🕵️Threat Intelligence

57
Hackernews
⚡ Weekly Recap: Telecom Sleeper Cells, LLM Jailbreaks, Apple Forces U.K. Age Checks and More↗2026-03-30
▶
Dfir Report
Lets Open(Dir) Some Presents: An Analysis of a Persistent Actor’s Activity↗2023-12-18
▶
Tenable
AA23-215A: 2022&#039;s Top Routinely Exploited Vulnerabilities↗2023-08-03
▶
Qualys
Why Is Snapshot Scanning Not Enough? | Qualys↗2022-11-01
▶
Qualys
Why Is Snapshot Scanning Not Enough?↗2022-11-01
▶
CVE-2020-14882 — CRITICAL severity | cvebase