Oracle WebLogic Server 12.2.1.3.0/12.2.1.4.0/14.1.1.0.0 Core Remote Code Execution

Summaryinfo

A vulnerability was found in Oracle WebLogic Server 12.2.1.3.0/12.2.1.4.0/14.1.1.0.0. It has been classified as very critical. The impacted element is an unknown function of the component Core. This manipulation causes Remote Code Execution. This vulnerability is registered as CVE-2020-14644. Remote exploitation of the attack is possible. Furthermore, an exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as very critical was found in Oracle WebLogic Server 12.2.1.3.0/12.2.1.4.0/14.1.1.0.0 (Application Server Software). Affected by this vulnerability is an unknown code block of the component Core. The manipulation with an unknown input leads to a remote code execution vulnerability. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

The weakness was published 07/15/2020 as Oracle Critical Patch Update Advisory - July 2020 as confirmed advisory (Website). It is possible to read the advisory at oracle.com. This vulnerability is known as CVE-2020-14644. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are unknown but an exploit is available. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 09/30/2024).

It is declared as attacked. We expect the 0-day to have been worth approximately $100k and more. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 09/18/2024 with a due date of 10/09/2024:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Upgrading eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Similar entries are available at VDB-158073, VDB-158074, VDB-158075 and VDB-158076. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Application Server Software

Vendor

• Oracle

Name

• WebLogic Server

Version

• 12.2.1.3.0
• 12.2.1.4.0
• 14.1.1.0.0

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion