Login Sign Up

CVE-2020-14882

9.8 CRITICAL
Remote Code Execution

📋 TL;DR

CVE-2020-14882 is a critical remote code execution vulnerability in Oracle WebLogic Server's Administration Console. Unauthenticated attackers can exploit this via HTTP to completely compromise affected WebLogic servers. All organizations running vulnerable versions of Oracle WebLogic Server are at risk.

💻 Affected Systems

Products:
  • Oracle WebLogic Server
Versions: 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
Operating Systems: All supported platforms
Default Config Vulnerable: ⚠️ Yes
Notes: Affects the Administration Console component specifically. All default installations with the console enabled are vulnerable.

📦 What is this software?

Weblogic Server by Oracle

View all CVEs affecting Weblogic Server →

Weblogic Server by Oracle

View all CVEs affecting Weblogic Server →

Weblogic Server by Oracle

View all CVEs affecting Weblogic Server →

Weblogic Server by Oracle

View all CVEs affecting Weblogic Server →

Weblogic Server by Oracle

View all CVEs affecting Weblogic Server →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete server takeover allowing attackers to execute arbitrary code, steal sensitive data, deploy ransomware, and pivot to internal networks.

🟠

Likely Case

Remote code execution leading to cryptocurrency mining, data exfiltration, or deployment of backdoors for persistent access.

🟢

If Mitigated

Limited impact if proper network segmentation, web application firewalls, and intrusion detection systems are in place to block exploitation attempts.

🌐 Internet-Facing: HIGH - Unauthenticated HTTP access makes internet-facing servers extremely vulnerable to widespread exploitation.
🏢 Internal Only: HIGH - Even internal servers are vulnerable to compromised internal hosts or insider threats due to the unauthenticated nature.

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: CONFIRMED
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

Multiple public proof-of-concept exploits exist and have been weaponized in real attacks. Exploitation requires only HTTP access to the vulnerable endpoint.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Apply patches from Oracle Critical Patch Update October 2020

Vendor Advisory: https://www.oracle.com/security-alerts/cpuoct2020.html

Restart Required: Yes

Instructions:

1. Download the appropriate patch from Oracle Support. 2. Stop the WebLogic Server. 3. Apply the patch according to Oracle's instructions. 4. Restart the WebLogic Server. 5. Verify the patch was applied successfully.

🔧 Temporary Workarounds

Block Console Access

linux

Restrict access to the WebLogic Administration Console via network controls

iptables -A INPUT -p tcp --dport 7001 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 7001 -j DROP

Disable Console

all

Temporarily disable the Administration Console if not required

Edit config.xml and set ConsoleEnabled to false

🧯 If You Can't Patch

  • Implement strict network segmentation to isolate WebLogic servers from untrusted networks
  • Deploy a web application firewall (WAF) with rules to block exploitation attempts

🔍 How to Verify

Check if Vulnerable:

Check if your WebLogic version matches affected versions and if the console is accessible via HTTP

Check Version:

java weblogic.version

Verify Fix Applied:

Verify patch installation via Oracle OPatch utility and test that console access no longer allows unauthenticated RCE

📡 Detection & Monitoring

Log Indicators:

  • Unusual HTTP requests to /console/console.portal
  • Unexpected process execution from WebLogic user
  • Authentication bypass attempts in access logs

Network Indicators:

  • HTTP POST requests to vulnerable console endpoints from unexpected sources
  • Outbound connections from WebLogic servers to suspicious IPs

SIEM Query:

source="weblogic_access.log" AND (uri="/console/console.portal" OR uri="/console/css/") AND status=200 AND user_agent NOT IN ("normal_user_agents")

📊 Metadata

CVE ID: CVE-2020-14882
CVSS v3 Score: 9.8 (CRITICAL)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: October 21, 2020
Last Updated: October 27, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON