PT-2014-1729 · Oracle · Oracle Weblogic Server

Published 2014-07-16 · Updated 2018-10-09 · CVE-2014-4254

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server versions 10.3.6.0 through 12.1.2.0

Description The issue allows remote attackers to compromise the confidentiality, integrity, and availability of data using WLS - Web Services. This affects the Oracle WebLogic Server component in Oracle Fusion Middleware.

Recommendations For versions 10.3.6.0 through 12.1.2.0, consider restricting access to WLS - Web Services until a patch is available. As a temporary workaround, consider disabling the use of WLS - Web Services in the affected Oracle WebLogic Server component until the issue is resolved.

Fix

Related Identifiers

BDU:2015-00742

CVE-2014-4254

Affected Products

Oracle Weblogic Server

References · 11

• http://oracle.com/technetwork/topics/security/cpujul2014-1972956.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-00742 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-4254 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4254 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4254 · Note
• http://seclists.org/fulldisclosure/2014/Dec/23 · Note
• http://vmware.com/security/advisories/VMSA-2014-0012.html · Note
• http://securityfocus.com/bid/68591 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/94545 · Note
• http://oracle.com/technetwork/topics/security/cpujul2014-1972956.html#AppendixFMW · Note
• http://securityfocus.com/archive/1/534161/100/0/threaded · Note