Oracle issued an out-of-band security update to address a critical remote code execution (RCE) vulnerability, tracked as CVE-2020-14750, which affects several versions of Oracle WebLogic Server.
The IT giant assigned to the flaw a severity base score of 9.8 out of 10.
According to Oracle, the issue was discovered thanks to the information provided by 20 organizations and security experts.
The advisory states that this vulnerability is related to the CVE-2020-14882 flaw that was addressed in the October 2020 Critical Patch Update.
The vulnerability could be exploited by unauthenticated attackers via HTTP without user interaction.
“It is remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password,” reads the advisory published by Oracle.
“Due to the severity of this vulnerability and the publication of exploit code on various sites, Oracle strongly recommends that customers apply the updates provided by this Security Alert as soon as possible.”
The Cybersecurity and Infrastructure Security Agency (CISA) also published an alert related to the vulnerability that urges users and administrators to apply the security update.
“Oracle has released an out-of-band security alert to address a remote code execution vulnerability—CVE-2020-14750—in Oracle WebLogic Server. A remote attacker can exploit this vulnerability to take control of an affected system.” reads the alert. “The Cybersecurity and Infrastructure Security Agency (CISA) urges users and administrators review the Oracle Security Alert and apply the necessary updates.”
The flaw affects Oracle WebLogic Server 10.3.6.0.0, 18.104.22.168.0, 22.214.171.124.0, 126.96.36.199.0, and 188.8.131.52.0 versions.
(SecurityAffairs – hacking, CVE-2020-14750 Oracle Weblogic Server flaw)
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.