PT-2023-9842 · Oracle · Oracle Weblogic Server

Boogipop

+3

·

Published

2023-12-07

·

Updated

2026-06-02

·

CVE-2024-21182

CVSS v2.0

7.8

High

VectorAV:N/AC:L/Au:N/C:C/I:N/A:N
Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server version 12.2.1.4.0 Oracle WebLogic Server version 14.1.1.0.0
Description A flaw in the Core component of Oracle WebLogic Server within Oracle Fusion Middleware is caused by insufficient input validation and a post-deserialization issue. This allows an unauthenticated remote attacker with network access via T3 and IIOP protocols to compromise the server. Successful exploitation can lead to unauthorized access to critical data or complete access to all accessible data on the server. There is evidence of active exploitation in the wild, with over 2.6 million services potentially affected worldwide.
Recommendations Update version 12.2.1.4.0 to the July 2024 security update. Update version 14.1.1.0.0 to the July 2024 security update. As a temporary mitigation, restrict network access to the T3 and IIOP protocols to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2025-00584
CVE-2024-21182
ORACLEWEBLOGIC_CVE2024_21182

Affected Products

Oracle Weblogic Server