CVE-2024-21182

Published Jul 16, 2024

Last updated 2 months ago

Exploit known CVSS high 7.5

Cloud

Network

API

Server

Database

Oracle WebLogic Server

Oracle Fusion Middleware

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-21182 is an authentication bypass vulnerability found in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. This flaw allows an unauthenticated attacker to gain unauthorized access to the server by exploiting network access via the T3 or IIOP protocols. Successful exploitation of this vulnerability can lead to unauthorized access to critical data or even complete access to all data accessible by the Oracle WebLogic Server. The affected versions include 12.2.1.4.0 and 14.1.1.0.0.

Description: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Source: secalert_us@oracle.com
NVD status: Analyzed
Products: weblogic_server

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: Oracle WebLogic Server Unspecified Vulnerability
Exploit added on: Jun 1, 2026
Exploit action due: Jun 4, 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

nvd@nist.gov: NVD-CWE-noinfo

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "4A5BB153-68E0-4DDA-87D1-0D9AB7F0A418",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "04BCDC24-4A21-473C-8733-0D9CFB38A752",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.