cbcvebase.
CVE-2022-21371
published 2022-01-19

CVE-2022-21371: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are…

PriorityP188high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
92.33%
99.8th percentile
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Affected

8 ranges
VendorProductVersion rangeFixed in
oracleweblogic_server
oracleweblogic_server
oracleweblogic_server
oracleweblogic_server
oracle_corporationweblogic_server
oracle_corporationweblogic_server
oracle_corporationweblogic_server
oracle_corporationweblogic_server

Detection & IOCsextracted from sources · hover to see the quote

path.//WEB-INF/weblogic.xml
path.//WEB-INF/web.xml
path.//WEB-INF/portlet.xml
  • HTTP GET requests using the './/WEB-INF/' or './/META-INF/' path traversal prefix pattern are characteristic of CVE-2022-21371 exploitation attempts against Oracle WebLogic Server.
  • Successful exploitation returns XML content; detect responses with Content-Type 'text/xml' or 'application/xml' to requests containing the './/WEB-INF/' path prefix.
  • Shodan/FOFA queries can identify exposed Oracle WebLogic instances as targets: search for HTTP title 'oracle peoplesoft sign-in' or product 'oracle weblogic'.
  • The vulnerability is in the Web Container component; unauthenticated HTTP GET requests with double-slash path traversal (e.g., './/WEB-INF/weblogic.xml') should be blocked or alerted at the WAF/proxy layer.
  • ·Affected versions are strictly 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0; detection rules should be scoped to these versions to reduce false positives.
  • ·The Nuclei template uses 'unsafe: true' and 'stop-at-first-match: true', meaning automated scanners may only send one of the two payload paths; defenders should monitor for all four known LFI path variants.

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vulncheck7.5HIGH
vendor_oracle7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.