Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2021-2135 — Improper Input Validation in Corporation Weblogic Server

CWE-20 — Improper Input Validation7 documents7 sources
Severity
9.8CRITICALNVD
EPSS
71.4%
top 1.28%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Oracle Corporation Weblogic ServerOracle Weblogic Server
Timeline
PublishedApr 22
Latest updateMar 4

Description

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence Container). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDoracle/weblogic_server12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0+2
▶CVEListV5oracle_corporation/weblogic_server12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0+2

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-vrrf-frmq-98j4: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence Container)↗2022-05-24
▶
CVEList
CVE-2021-2135: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence Container)↗2021-04-22
▶
VulnCheck
Oracle Fusion Middleware WebLogic Server Coherence Container Security Bypass↗2021
▶

💥Exploits & PoCs

1
Nuclei
Oracle WebLogic Server - Remote Code Execution
▶

📋Vendor Advisories

2
Red Hat
kernel: mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page()↗2024-03-04
▶
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Coherence Container — CVE-2021-2135↗2021-04-15
▶
CVE-2021-2135 — Improper Input Validation | cvebase