Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2020-14882
HistoryOct 21, 2020 - 3:15 p.m.

CVE-2020-14882

2020-10-2115:15:25
[email protected]
web.nvd.nist.gov
1412
In Wild
36
oracle
weblogic
server
vulnerability
oracle fusion middleware
cve-2020-14882
nvd
cvss
http
takeover
unauthenticated access

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.975 High

EPSS

Percentile

100.0%

JSON

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected configurations

Vulners
NVD
Node
oracleweblogic_serverRange≤10.3.6.0.0
OR
oracleweblogic_serverRange≤12.1.3.0.0
OR
oracleweblogic_serverRange≤12.2.1.3.0
OR
oracleweblogic_serverRange≤12.2.1.4.0
OR
oracleweblogic_serverRange≤14.1.1.0.0
VendorProductVersionCPE
oracleweblogic_server*cpe:2.3:a:oracle:weblogic_server:*:*:*:*:*:*:*:*
oracleweblogic_server*cpe:2.3:a:oracle:weblogic_server:*:*:*:*:*:*:*:*
oracleweblogic_server*cpe:2.3:a:oracle:weblogic_server:*:*:*:*:*:*:*:*
oracleweblogic_server*cpe:2.3:a:oracle:weblogic_server:*:*:*:*:*:*:*:*
oracleweblogic_server*cpe:2.3:a:oracle:weblogic_server:*:*:*:*:*:*:*:*

CNA Affected

[
  {
    "product": "WebLogic Server",
    "vendor": "Oracle Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "10.3.6.0.0"
      },
      {
        "status": "affected",
        "version": "12.1.3.0.0"
      },
      {
        "status": "affected",
        "version": "12.2.1.3.0"
      },
      {
        "status": "affected",
        "version": "12.2.1.4.0"
      },
      {
        "status": "affected",
        "version": "14.1.1.0.0"
      }
    ]
  }
]

Social References

More

Related

impervablog 3
githubexploit 25
nvd 1
exploitdb 2
nessus 2
metasploit 1
cvelist 1
packetstorm 3
malwarebytes 1
kitploit 2
prion 1
nuclei 2
trendmicroblog 3
threatpost 4
thn 8
cisa_kev 2
rapid7blog 1
zdt 1
attackerkb 3
checkpoint_advisories 1
qualysblog 3
ics 2
oracle 1
impervablog
impervablog
Bug hunting for a quick buck using WebLogic vulnerability (CVE-2020–14882)
2020-11-02 15:47:04
Attackers exploit CVE-2021-26084 for XMRig crypto mining on affected Confluence servers
2021-09-13 14:57:52
Imperva Detects Undocumented 8220 Gang Activities
2023-12-14 13:48:35
githubexploit
githubexploit
Exploit for CVE-2020-14882
2020-11-09 08:03:44
Exploit for CVE-2020-14882
2020-11-04 03:09:13
Exploit for CVE-2020-14882
2020-10-29 13:53:31
nvd
nvd
CVE-2020-14882
2020-10-21 15:15:25
exploitdb
exploitdb
WebLogic Server 10.3.6.0.0 / 12.1.3.0.0 / 12.2.1.3.0 / 12.2.1.4.0 / 14.1.1.0.0 - Unauthenticated RCE via GET request
2020-10-29 00:00:00
Oracle WebLogic Server 12.2.1.0 - RCE (Unauthenticated)
2021-01-26 00:00:00
nessus
nessus
Oracle WebLogic Server RCE (CVE-2020-14882)
2020-11-06 00:00:00
Oracle WebLogic Server Multiple Vulnerabilities (Oct 2020 CPU)
2020-10-22 00:00:00
metasploit
metasploit
Oracle WebLogic Server Administration Console Handle RCE
2020-11-18 16:56:02
cvelist
cvelist
CVE-2020-14882
2020-10-21 14:04:30
packetstorm
packetstorm
Oracle WebLogic Server Remote Code Execution
2020-10-29 00:00:00
Oracle WebLogic Server 12.2.1.0 Remote Code Execution
2021-01-26 00:00:00
Oracle WebLogic Server Administration Console Handle Remote Code Execution
2020-11-19 00:00:00
malwarebytes
malwarebytes
A week in security (October 26 – November 1)
2020-11-02 17:46:12
kitploit
kitploit
Melody - A Transparent Internet Sensor Built For Threat Intelligence
2022-04-13 12:30:00
Vulmap - Web Vulnerability Scanning And Verification Tools
2020-12-25 11:30:00
prion
prion
Design/Logic Flaw
2020-10-21 15:15:00
nuclei
nuclei
Oracle Weblogic Server - Remote Command Execution
2020-10-29 12:58:49
Oracle WebLogic Server - Remote Command Execution
2021-04-23 12:39:54
trendmicroblog
trendmicroblog
A Post-exploitation Look at Coinminers Abusing WebLogic Vulnerabilities
2022-09-14 00:00:00
Tracking CVE-2021-26084 and Other Server-Based Vulnerability Exploits via Trend Micro Cloud One and Trend Micro Vision One
2021-10-18 00:00:00
Tracking CVE-2021-26084 and Other Server-Based Vulnerability Exploits via Trend Micro Cloud One and Trend Micro Vision One
2021-10-18 00:00:00
threatpost
threatpost
Golang Cryptomining Worm Offers 15% Speed Boost
2021-08-06 20:41:40
WordPress Patches 3-Year-Old High-Severity RCE Bug
2020-10-30 20:56:19
Oracle WebLogic Server RCE Flaw Under Active Attack
2020-10-29 14:49:58
thn
thn
Hackers Targeting WebLogic Servers and Docker APIs for Mining Cryptocurrencies
2022-09-16 10:58:00
Multiple Botnets Exploiting Critical Oracle WebLogic Bug — PATCH NOW
2020-12-02 09:20:00
Cybercriminals Targeting Apache NiFi Instances for Cryptocurrency Mining
2023-05-31 15:44:00
cisa_kev
cisa_kev
Oracle WebLogic Server Remote Code Execution Vulnerability
2021-11-03 00:00:00
Oracle WebLogic Server Remote Code Execution Vulnerability
2021-11-03 00:00:00
rapid7blog
rapid7blog
Oracle WebLogic Unauthenticated Complete Takeover (CVE-2020-14882/CVE-2020-14750): What You Need to Know
2020-10-29 20:43:56
zdt
zdt
Oracle WebLogic Server Administration Console Handle Remote Code Execution Exploit
2020-11-19 00:00:00
attackerkb
attackerkb
CVE-2020-14750 — Oracle WebLogic Remote Unauthenticated Remote Code Execution (RCE) Vulnerability
2020-11-02 00:00:00
CVE-2020-2555
2020-01-15 00:00:00
CVE-2020-14882 — Unauthenticated RCE in Console component of Oracle WebLogic Server
2020-10-21 00:00:00
checkpoint_advisories
checkpoint_advisories
Oracle WebLogic Remote Code Execution (CVE-2020-14882; CVE-2020-14750; CVE-2020-14825; CVE-2020-14883)
2020-11-01 00:00:00
qualysblog
qualysblog
Why Is Snapshot Scanning Not Enough?
2022-11-01 13:27:50
Russia-Ukraine Crisis: How to Strengthen Your Security Posture to Protect against Cyber Attack, based on CISA Guidelines
2022-02-26 20:20:32
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR
2022-02-23 05:39:00
ics
ics
Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S. Critical Infrastructure
2022-03-01 12:00:00
2022 Top Routinely Exploited Vulnerabilities
2023-08-03 12:00:00
oracle
oracle
Oracle Critical Patch Update Advisory - October 2020
2020-10-20 00:00:00

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.975 High

EPSS

Percentile

100.0%

JSON
Related for CVE-2020-14882
impervablog3githubexploit25nvd1exploitdb2nessus2metasploit1cvelist1packetstorm3malwarebytes1kitploit2prion1nuclei2trendmicroblog3threatpost4thn8cisa_kev2rapid7blog1zdt1attackerkb3checkpoint_advisories1qualysblog3ics2oracle1