Oracle Releases Security Update

Threat ID:: CC-3658
Threat Severity:: Information only
Published:: 9 November 2020 12:00 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Affected platforms

The following platforms are known to be affected:

Versions: 10.3.6.00, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0

Oracle WebLogic Server

Threat details

Introduction

Oracle has released an out-of-band security alert to address a remote code execution vulnerability, CVE-2020-14750, in Oracle WebLogic Server. A remote attacker can exploit this vulnerability to take control of an affected system.

Remediation advice

Affected organisations are encouraged to review Oracle's Security Alert Advisory - CVE-2020-14750, and apply the necessary updates.

CVE Vulnerabilities

Status Master

CVE-2020-14750

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Last edited: 9 November 2020 1:04 pm