PT-2024-6823 · Oracle · Oracle Weblogic Server

Markus Wulftange

+7

·

Published

2024-10-15

·

Updated

2026-06-02

·

CVE-2024-21216

CVSS v2.0

10

Critical

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0
Description The issue is related to a vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware, specifically in the Core component. This vulnerability allows an unauthenticated attacker with network access via T3, IIOP to compromise the Oracle WebLogic Server. Successful attacks can result in the takeover of the Oracle WebLogic Server. It is estimated that over 18,000 services are potentially affected. The vulnerability can be exploited by sending specially crafted network packets, allowing an attacker to gain full access to the vulnerable software.
Recommendations For Oracle WebLogic Server version 12.2.1.4.0, update to a newer version to mitigate the risk. For Oracle WebLogic Server version 14.1.1.0.0, update to a newer version to mitigate the risk. As a temporary workaround, consider restricting access to the T3 and IIOP protocols to minimize the risk of exploitation.

Fix

Missing Authorization

RCE

Weakness Enumeration

CWE-862CWE-20

Related Identifiers

BDU:2024-08042
CVE-2024-21216

Affected Products

Oracle Weblogic Server