CVEvulnerability

CVE-2023-21839

7.5 HIGH Known exploited Published 2023-01-18 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Oracle WebLogic Server Unspecified Vulnerability — Oracle WebLogic Server

Oracle WebLogic Server contains an unspecified vulnerability that allows an unauthenticated attacker with network access via T3, IIOP, to compromise Oracle WebLogic Server.

Added to KEV
2023-05-01
Remediation due
2023-05-22
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Notes
https://www.oracle.com/security-alerts/cpujan2023.html; https://nvd.nist.gov/vuln/detail/CVE-2023-21839
Status
Analyzed
Published
2023-01-18
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-306, CWE-502

Description

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Affected configurations

• oracle weblogic server 12.2.1.3.0 • oracle weblogic server 12.2.1.4.0 • oracle weblogic server 14.1.1.0.0

Related

Weakness · CWE (2)

  • CWE-306 Missing Authentication for Critical Functionality weakness
  • CWE-502 Deserialization of Untrusted Data weakness

References