CVE-2020-14750
Summary
| CVE | CVE-2020-14750 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-11-02 21:15:00 UTC |
| Updated | 2022-07-01 16:26:00 UTC |
| Description | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). |
Risk And Classification
EPSS: 0.944380000 probability, percentile 0.999880000 (date 2026-04-01)
CISA KEV: Listed on 2021-11-03; due 2022-05-03; ransomware use Unknown
Problem Types: NVD-CWE-noinfo
CISA Known Exploited Vulnerability
| Vendor | Oracle |
|---|---|
| Product | WebLogic Server |
| Name | Oracle WebLogic Server Remote Code Execution Vulnerability |
| Required Action | Apply updates per vendor instructions. |
| Notes | https://nvd.nist.gov/vuln/detail/CVE-2020-14750 |
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Oracle | Fusion Middleware | 10.3.6.0 | All | All | All |
| Application | Oracle | Fusion Middleware | 12.1.3.0 | All | All | All |
| Application | Oracle | Fusion Middleware | 12.2.1.3.0 | All | All | All |
| Application | Oracle | Fusion Middleware | 12.2.1.4.0 | All | All | All |
| Application | Oracle | Fusion Middleware | 14.1.1.0.0 | All | All | All |
| Application | Oracle | Fusion Middleware | 10.3.6.0 | All | All | All |
| Application | Oracle | Fusion Middleware | 12.1.3.0 | All | All | All |
| Application | Oracle | Fusion Middleware | 12.2.1.3.0 | All | All | All |
| Application | Oracle | Fusion Middleware | 12.2.1.4.0 | All | All | All |
| Application | Oracle | Fusion Middleware | 14.1.1.0.0 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Oracle WebLogic Server Administration Console Handle Remote Code Execution ≈ Packet Storm | MISC | packetstormsecurity.com | |
| Oracle Security Alert - CVE-2020-14750 | MISC | www.oracle.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
| CISA Known Exploited Vulnerabilities catalog | CISA | www.cisa.gov | kev |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.