Security News > 2020 > October > Easily exploitable RCE in Oracle WebLogic Server under attack (CVE-2020-14882)
A critical and easily exploitable remote code execution vulnerability in Oracle WebLogic Server is being targeted by attackers, SANS ISC has warned.
Oracle WebLogic is a Java EE application server that is part of Oracle's Fusion Middleware portfolio and supports a variety of popular databases.
The vulnerability affects the console component of Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0, and has been patched by Oracle last week.
The exploit allows attackers to achieve RCE on a vulnerable Oracle WebLogic Server by sending a HTTP GET request.
Oracle has flagged today a new remote code execution vulnerability in Oracle WebLogic Server that is related to the one patched two weeks ago.
News URL
http://feedproxy.google.com/~r/HelpNetSecurity/~3/SePEJleLRVI/
Related news
- Samsung MagicINFO 9 Server RCE flaw now exploited in attacks (source)
- CISA Warns of CentreStack's Hard-Coded MachineKey Vulnerability Enabling RCE Attacks (source)
- CentreStack RCE exploited as zero-day to breach file sharing servers (source)
- Oracle says "obsolete servers" hacked, denies cloud breach (source)
- New BPFDoor Controller Enables Stealthy Lateral Movement in Linux Server Attacks (source)
- Active! Mail RCE flaw exploited in attacks on Japanese orgs (source)
- Craft CMS RCE exploit chain used in zero-day attacks to steal data (source)
- Hitachi Vantara takes servers offline after Akira ransomware attack (source)
- Apple 'AirBorne' flaws can lead to zero-click AirPlay RCE attacks (source)
- Critical Langflow RCE flaw exploited to hack AI app servers (source)