⚠ Actively exploited
Added to CISA KEV on 2021-11-03. Federal agencies required to patch by 2022-05-03. Required action: Apply updates per vendor instructions..

CVE-2020-14883 — Corporation Weblogic Server vulnerability

35 documents15 sources
Severity
7.2HIGHNVD
EPSS
94.4%
top 0.01%
CISA KEV
KEV
Added 2021-11-03
Due 2022-05-03
Exploit
Exploited in wild
Active exploitation observed
Affected products
2
Oracle Corporation Weblogic ServerOracle Weblogic Server
Timeline
PublishedOct 21
KEV addedNov 3
KEV dueMay 3
Latest updateMar 30
CISA Required Action: Apply updates per vendor instructions.

Description

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability im…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages2 packages

▶NVDoracle/weblogic_server5 versions+4
▶CVEListV5oracle_corporation/weblogic_server5 versions+4

🔴Vulnerability Details

3
GHSA
GHSA-26xh-4mrc-q8jf: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)↗2022-05-24
▶
CVEList
CVE-2020-14883: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)↗2020-10-21
▶
VulnCheck
Oracle WebLogic Server Unspecified Vulnerability↗2020
▶

💥Exploits & PoCs

2
Nuclei
Oracle Fusion Middleware WebLogic Server Administration Console - Remote Code Execution
▶
Metasploit
Oracle WebLogic Server Administration Console Handle RCE↗
▶

🔍Detection Rules

6
Suricata
ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Inbound M5 (CVE-2020-14882)↗2020-11-06
▶
Suricata
ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Inbound M4 (CVE-2020-14882)↗2020-11-06
▶
Suricata
ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Inbound M3 (CVE-2020-14882)↗2020-11-06
▶
Suricata
ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Inbound M2 (CVE-2020-14882)↗2020-11-06
▶
Suricata
ET WEB_SPECIFIC_APPS Oracle WebLogic RCE Shell Inbound M2 (CVE-2020-14882)↗2020-10-30
▶

📋Vendor Advisories

2
CISA
Oracle WebLogic Server Unspecified Vulnerability↗2021-11-03
▶
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Console — CVE-2020-14883↗2020-10-15
▶

🕵️Threat Intelligence

21
Hackernews
⚡ Weekly Recap: Telecom Sleeper Cells, LLM Jailbreaks, Apple Forces U.K. Age Checks and More↗2026-03-30
▶
Wiz
Crying Out Cloud - January Newsletter | Wiz↗2024-01-01
▶
Tenable
AA23-215A: 2022's Top Routinely Exploited Vulnerabilities↗2023-08-03
▶
Trendmicro
A Post-exploitation Look at Coinminers Abusing WebLogic Vulnerabilities↗2022-09-14
▶
Trendmicro
A Post-exploitation Look at Coinminers Abusing WebLogic Vulnerabilities↗2022-09-14
▶
CVE-2020-14883 — HIGH severity | cvebase