7.5
CVSSv3

CVE-2023-21931

Published: 18/04/2023 Updated: 12/06/2023
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
VMScore: 0

Vulnerability Summary

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

oracle weblogic server 12.2.1.3.0

oracle weblogic server 12.2.1.4.0

oracle weblogic server 14.1.1.0.0

Vendor Advisories

Check Point Reference: CPAI-2023-0383 Date Published: 24 Aug 2023 Severity: High ...

Exploits

Oracle Weblogic versions 122130, 122140 and 141100 prior to the Jan 2023 security update are vulnerable to an unauthenticated remote code execution vulnerability due to a post deserialization vulnerability This Metasploit module exploits this vulnerability to trigger the JNDI connection to a LDAP server you control The LDAP server wil ...

Github Repositories

POC&EXP of CVE-2023-21931 CVE-2023-21931 Analysis Article JNDI-Injection-Exploit Description Before running the PoC script, it's advisable to add the following JAR files as library dependencies: coherence\lib oracle_common\lib oracle_common\modules wlserver\modules POC&EXP satoshi-boxcom/pay/CJhZuu