APP: Oracle WebLogic CVE-2020-14841 IIOP JNDI Injection
This signature detects attempts to exploit a known command injection vulnerability in Oracle WebLogic. This vulnerability is due to improper handling of specific IIOP protocol messages. A remote, unauthenticated attacker can exploit this vulnerability by sending a crafted request to a vulnerable server. Successful exploitation results in the target server retrieving a potentially malicious serialized object from an attacker controlled server which may lead to the execution of arbitrary code under the security context of the affected server.
Extended Description
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Products
Oracle weblogic_server
References
CVE: CVE-2020-14841
Short Name
APP:ORACLE:WEBLOGIC-JNDI-INJ
Severity
Major
Recommended
True
Recommended Action
Drop
Category
APP
Keywords
CVE-2020-14841 IIOP Injection JNDI Oracle WebLogic
Release Date
12/01/2020
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3337
Port
TCP/7001
False Positive
Unknown
Vendors
Oracle
CVSS Score
7.5