PT-2025-29628 · Oracle · Oracle Weblogic Server

Published 2025-07-15 · Updated 2025-07-24 · CVE-2025-50073

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server versions 12.2.1.4.0 Oracle WebLogic Server versions 14.1.1.0.0 Oracle WebLogic Server versions 14.1.2.0.0

Description This issue affects the Web Container component of Oracle WebLogic Server. An unauthenticated attacker with network access via HTTP can compromise the server. Successful attacks require human interaction from a person other than the attacker and may impact additional products. Successful exploitation can result in unauthorized data modification, insertion, deletion, and read access.

Recommendations For Oracle WebLogic Server version 12.2.1.4.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Oracle WebLogic Server version 14.1.1.0.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Oracle WebLogic Server version 14.1.2.0.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

BDU:2025-08655

CVE-2025-50073

Affected Products

Oracle Weblogic Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-50073 · Security Note
• https://oracle.com/security-alerts/cpujul2025.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08655 · Security Note
• https://osv.dev/vulnerability/CVE-2025-50073 · Vendor Advisory
• https://twitter.com/dailycve/status/1948490044471464141 · Twitter Post
• https://twitter.com/CVEnew/status/1945207856531218724 · Twitter Post