PT-2025-29627 · Oracle · Oracle Weblogic Server

Iuhrm · Published 2025-07-15 · Updated 2025-07-24 · CVE-2025-50072

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server versions 12.2.1.4.0 Oracle WebLogic Server versions 14.1.1.0.0 Oracle WebLogic Server versions 14.1.2.0.0

Description An easily exploitable issue exists in the Oracle WebLogic Server Core component, allowing an unauthenticated attacker with logon to the infrastructure to compromise the server. Successful exploitation can lead to unauthorized modification, insertion, or deletion of data accessible by Oracle WebLogic Server.

Recommendations Update Oracle WebLogic Server version 12.2.1.4.0 to a newer, fixed version. Update Oracle WebLogic Server version 14.1.1.0.0 to a newer, fixed version. Update Oracle WebLogic Server version 14.1.2.0.0 to a newer, fixed version.

Fix

Improper Access Control

RCE

Weakness Enumeration

CWE-284

CWE-20

Related Identifiers

BDU:2025-09725

CVE-2025-50072

Affected Products

Oracle Weblogic Server

References · 7

• https://osv.dev/vulnerability/CVE-2025-50072 · Vendor Advisory
• https://oracle.com/security-alerts/cpujul2025.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09725 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-50072 · Security Note
• https://twitter.com/dailycve/status/1948492418065858697 · Twitter Post
• https://twitter.com/CVEnew/status/1945207857441280291 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2025071676 · Note