QID 150477

Date Published: 2022-03-07

QID 150477: Oracle WebLogic Server Multiple Vulnerabilities (CPUOCT2021)

Oracle WebLogic Server is a robust, highly performant, and scalable application server for building and deploying both enterprise Java EE and Jakarta EE applications.

Oracle WebLogic Server contains multiple vulnerabilities:
CVE-2021-35552: Vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.

CVE-2021-35617: Vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server.

Affected versions:
Oracle WebLogic Server, version(s) 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0

QID Detection Logic:
The QID sends a "GET console/login/LoginForm.jsp" request to retrieve the WebLogic version installed.

Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data.

CVSS V3 rated as Critical - 9.8 severity.

CVSS V2 rated as High - 7.5 severity.

Solution

The vendor has released patches for these issues. Customers are advised to refer to Oracle - CPUOCT2021

Vendor References

CPUOCT2021 - www.oracle.com/security-alerts/cpuoct2021.html

CVEs related to QID 150477

CVE-2021-35552 | CVE-2021-35617 |

Software Advisories

Advisory ID	Software	Component	Link
CPUOCT2021			www.oracle.com/security-alerts/cpuoct2021.html

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].