PT-2020-4510 · Oracle · Oracle Weblogic Server

0Xd0Ff9 + 18 · Published 2020-11-01 · Updated 2026-01-12 · CVE-2020-14750

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server versions 10.3.6.0.0 through 14.1.1.0.0

Description The issue is related to a vulnerability in the Oracle WebLogic Server product, specifically in the Console component. This vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the Oracle WebLogic Server, potentially resulting in a takeover. The vulnerability is easily exploitable and can impact the confidentiality, integrity, and availability of the server. It is associated with errors in code generation management and can be exploited using HTTP requests.

Recommendations For versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0, update to a version that includes the emergency patch released by Oracle to fix this critical flaw. As a temporary workaround, consider restricting access to the Console component until a patch is applied. Avoid using the vulnerable Console component in the affected Oracle WebLogic Server versions until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2020-05059

CVE-2020-14750

Affected Products

Oracle Weblogic Server

References · 17

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/weblogic_admin_handle_rce.rb · Exploit
• 🔥 https://github.com/pprietosanchez/CVE-2020-14750 · Exploit
• https://oracle.com/security-alerts/alert-cve-2020-14750.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14750 · Security Note
• https://osv.dev/vulnerability/CVE-2020-14750 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05059 · Security Note
• https://t.me/freedomf0x/10243 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2020110201 · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-14750 · Note
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://t.me/aptreports/3250 · Telegram Post
• https://t.me/cibsecurity/15802 · Telegram Post
• http://packetstormsecurity.com/files/160143/Oracle-WebLogic-Server-Administration-Console-Handle-Remote-Code-Execution.html · Note
• https://t.me/defcon_news/60740 · Telegram Post
• https://t.me/echeloneyes/1053 · Telegram Post