Oracle WebLogic Server 12.2.1.4.0/14.1.1.0.0/14.1.2.0.0 Core access control

Summaryinfo

A vulnerability was found in Oracle WebLogic Server 12.2.1.4.0/14.1.1.0.0/14.1.2.0.0. It has been declared as critical. The affected element is an unknown function of the component Core. The manipulation results in Local Privilege Escalation. This vulnerability is identified as CVE-2025-50072. The attack is only possible with local access. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Oracle WebLogic Server 12.2.1.4.0/14.1.1.0.0/14.1.2.0.0. Affected is some unknown processing of the component Core. The manipulation with an unknown input leads to a local privilege escalation vulnerability. CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle WebLogic Server executes to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 4.0 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).

The advisory is shared for download at oracle.com. This vulnerability is traded as CVE-2025-50072 since 06/12/2025. The exploitability is told to be easy. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Application Server Software

Vendor

• Oracle

Name

• WebLogic Server

Version

• 12.2.1.4.0
• 14.1.1.0.0
• 14.1.2.0.0

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion