Paper/Archive/CVE-2024-21175

CVE-2024-21175

Oracle Corporation WebLogic Server — Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).

EPSS 0.4%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (NVD)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 38.8.388 × 207.8 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

Affected

ProductAffectedFixed inSource

WebLogic Server12.2.1.4.0–CNA

WebLogic Server14.1.1.0.0–CNA

weblogic_server12.2.1.4.0–CISA-ADP

weblogic_server14.1.1.0.0–CISA-ADP

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

oracle (CNA)7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

advisoryoracle.com/security-alerts/cpujul2024.html