CVE-2020-14883

CVE-2020-14883 is a vulnerability in the Console component of Oracle WebLogic Server that is exploitable over HTTP by a high-privileged attacker with network access; a successful attack results in complete takeover of the WebLogic Server, with high impact to confidentiality, integrity, and availability (CVSS 3.1 score 7.2). Oracle rates it as easily exploitable (low attack complexity, no user interaction required), and public reporting on the actively exploited WebLogic flaws describes unauthenticated attackers accessing critical data, typically because the required privileged console access is first obtained via the related unauthenticated console flaw fixed in the same October 2020 Critical Patch Update. All supported WebLogic versions listed by Oracle are affected - 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 - wherever the administration console is network-reachable. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2021-11-03 with applying vendor updates as the required action, EPSS assigns a 97.9% probability of exploitation within 30 days (100th percentile), and public reporting describes malware campaigns against exposed WebLogic servers, including the 8220 gang exploiting older WebLogic flaws to deliver infostealers and cryptominers.

What to do: Apply Oracle's October 2020 Critical Patch Update or later to all affected WebLogic Server versions (10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0), per the vendor's instructions. Until patched, restrict HTTP access to the WebLogic administration console to trusted admin networks and hunt for signs of compromise on internet-facing consoles, given confirmed in-the-wild exploitation and malware campaigns targeting exposed servers.