Skip to content
OpenAdvisories
Critical · 9.8 Known exploited Scanner template Public exploit CVE-2020-14882 EUVD-2020-7018GHSA-98w2-f859-jh76

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected …

Published Oct 21, 2020 · Updated Jan 12, 2026 · Assigned by oracle

Vendor: Oracle Product: WebLogic Server

Description

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected products

VendorProductAffectedFixed
Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

Exploit-DB 1

GitHub 37 repositories · most starred shown

  • zhzyker/exphub ★ 4,297 · Apr 1, 2020

    Exphub[漏洞利用脚本库] 包括Webloigc、Struts2、Tomcat、Nexus、Solr、Jboss、Drupal的漏洞利用脚本，最新添加CVE-2020-14882、CVE-2020-11444、CVE-2020-10204、CVE-2020-10199、CVE-2020-1938、CVE-2020-2551、CVE-2020-2555、CVE-2020-2883、CVE-20…

  • jas502n/CVE-2020-14882 ★ 287 · Oct 28, 2020

    CVE-2020–14882、CVE-2020–14883

  • GGyao/CVE-2020-14882_ALL ★ 144 · Nov 3, 2020

    CVE-2020-14882_ALL综合利用工具，支持命令回显检测、批量命令回显、外置xml无回显命令执行等功能。

  • s1kr10s/CVE-2020-14882 ★ 29 · Oct 28, 2020

    CVE-2020–14882 by Jang

  • NS-Sp4ce/CVE-2020-14882 ★ 19 · Nov 4, 2020

    CVE-2020-14882/14883/14750

  • XTeam-Wing/CVE-2020-14882 ★ 17 · Oct 29, 2020

    CVE-2020-14882 Weblogic-Exp

  • adm1in/CodeTest ★ 13 · Dec 30, 2020

    CodeTest信息收集和漏洞利用工具，可在进行渗透测试之时方便利用相关信息收集脚本进行信息的获取和验证工作，漏洞利用模块可选择需要测试的漏洞模块，或者选择所有模块测试，包含CVE-2020-14882, CVE-2020-2555等，可自己收集脚本后按照模板进行修改。

  • GGyao/CVE-2020-14882_POC ★ 12 · Oct 31, 2020

    CVE-2020-14882批量验证工具。

  • milo2012/CVE-2020-14882 ★ 8 · Feb 25, 2021

    CVE-2020-14882

  • ludy-dev/Weblogic_Unauthorized-bypass-RCE ★ 8 · Nov 1, 2020

    (CVE-2020-14882) Oracle Weblogic Unauthorized bypass RCE test script

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

References