CVE-2024-20931

published 2024-02-17

CVE-2024-20931: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and…

Priority P2 68 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Affected

4 ranges

Vendor	Product	Version range	Fixed in
oracle	weblogic_server	—	—
oracle	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—

Detection & IOCs extracted from sources · hover to see the quote

port 7001

snort

alert tcp $EXTERNAL_NET any -> $HOME_NET 7001 (msg:"ET WEB_SPECIFIC_APPS Possible Oracle Weblogic IIOP/T3 JNDI Injection Attack (CVE-2024-20931)"; flow:established,to_server; content:"java.naming.factory.initial"; fast_pattern; content:"jmsInitialContextFactory"; within:60; content:"datasource"; within:20; content:"ldap|3a 2f 2f|"; pcre:"/^(\d{1,3}\.){3}\d{1,3}\x3a\d{1,5}\x2f/R"; reference:url,attackerkb.com/topics/GizBcG19y2/cve-2024-20931; reference:cve,2024-20931; classtype:attempted-admin; sid:2050791; rev:1; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2024_02_12, cve CVE_2024_20931, deployment Perimeter, deployment Internal, performance_impact Low, confidence Low, signature_severity Major, updated_at 2024_02_12; target:dest_ip;)

bytes

java.naming.factory.initial

bytes

jmsInitialContextFactory

bytes

datasource

bytes

ldap|3a 2f 2f|

• → Monitor TCP traffic to WebLogic's default port 7001 for JNDI injection payloads over T3 and IIOP protocols; look for the combination of 'java.naming.factory.initial', 'jmsInitialContextFactory', 'datasource', and an ldap:// URI with an IP:port/path pattern in the same flow.
• → The vulnerability is exploitable by unauthenticated remote attackers via T3 and IIOP protocols — block or restrict external access to WebLogic T3/IIOP listeners (default port 7001) at the network perimeter. ↗
• → The PCRE pattern in the Snort rule matches an ldap:// URI pointing to an attacker-controlled IP:port/path, characteristic of JNDI callback infrastructure used in this exploit.

• · The Emerging Threats Snort rule (sid:2050791) is marked with confidence Low — tune carefully before deploying in blocking mode to avoid false positives.
• · Affected versions are specifically 12.2.1.4.0 and 14.1.1.0.0; detections should be scoped to environments running these Oracle WebLogic Server versions. ↗
• · The rule is designed for both perimeter and internal deployment, indicating the threat is relevant even for east-west traffic within the network.

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vendor_oracle 7.5 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-284