Security News > 2020 > November > Oracle Rushes Emergency Fix for Critical WebLogic Server Flaw
While specific details of the flaw were not disclosed, Oracle's alert said it exists in the Console of the Oracle WebLogic Server and can be exploited via the HTTP network protocol.
Oracle WebLogic Server is a popular application server used in building and deploying enterprise Java EE applications.
Oracle released an out-of-band security alert to address a vulnerability-CVE-2020-14750-in Oracle WebLogic Server.
"Oracle WebLogic servers continue to be hard-hit with exploits. In May, Oracle urged customers to fast-track a patch for a critical flaw in its WebLogic Server under active attack. The company said it has received numerous reports that attackers were targeting the vulnerability patched last month. In May 2019, researchers warned that malicious activity exploiting a recently disclosed Oracle WebLogic critical deserialization vulnerability was surging - including to spread the REvil/Sodinokibi" ransomware.
In June 2019, Oracle said that a critical remote code-execution flaw in its WebLogic Server was being actively exploited in the wild.
News URL
https://threatpost.com/oracle-update-weblogic-server-flaw/160889/
Related news
- Mitel MiCollab, Oracle WebLogic Server vulnerabilities exploited by attackers (source)
- New critical Apache Struts flaw exploited to find vulnerable servers (source)
- CISA warns of critical Oracle, Mitel flaws exploited in attacks (source)
- CISA Flags Critical Flaws in Mitel and Oracle Systems Amid Active Exploitation (source)
- SAP fixes critical vulnerabilities in NetWeaver application servers (source)
- Critical SimpleHelp vulnerabilities fixed, update your server instances! (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-11-02 | CVE-2020-14750 | Unspecified vulnerability in Oracle Fusion Middleware Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). | 0.0 |