Oracle Security Alert for CVE-2020-14750 - Oracle CVRF
Oracle Security Alert
CVE-2020-14750
Final
2
2
2020-11-06T13:43:00-07:00
Credit update.
2020-11-01T15:00:00-07:00
2020-11-06T13:43:00-07:00
This document contains descriptions of Oracle product security vulnerabilities which have had security patches released for all supported versions and platforms for the associated product. Additional information regarding these vulnerabilities including security patch distribution information can be found at the Oracle sites referenced in this document.
This document is published at: https://www.oracle.com/a/tech/docs/cve-2020-14750cvrf.xml
https://www.oracle.com/security-alerts/alert-cve-2020-14750.html
URL to html version of Advisory
Huang Xiaopeng
360CERT at QiHu360
Bui Dinh Bao aka 0xd0ff9 of Zalo Security Team (VNG Corp)
Jacky Xing
Dbappsecurity Team
Maoxin Lin
Dbappsecurity Team
Shimizu Kawasaki
Asiainfo-sec of CSS Group
Hoang Quoc Thinh of RedTeam (VNG Corp)
Tonghua Root
Tonghua Root
Xianglai Liu
Dbappsecurity Team
Yu Wang
BMH Security Team
Yuxuan Chen
Yuxuan Chen
Zhiyi Zhang from Codesafe Team of Legendsec at Qi'anxin Group
360QUAKE TEAM
voidfyoo of Chaitin Security Research Lab
codeplutos
AntGroup FG Security Lab
f1v3 jacky
f1v3 jacky
icez
Tophant Competence Center
mayoterry
Qingteng 73Lab Security Team
ph4nt0mer
ph4nt0mer
r00t4dm from A-TEAM of Legendsec at Qi'anxin Group
tcc
tcc
WebLogic Server Version 10.3.6.0.0
WebLogic Server Version 12.1.3.0.0
WebLogic Server Version 12.2.1.3.0
WebLogic Server Version 12.2.1.4.0
WebLogic Server Version 14.1.1.0.0
CVE-2020-14750
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Security patch has been released
CVE-2020-14750
P-5242V-10.3.6.0.0
P-5242V-12.1.3.0.0
P-5242V-12.2.1.3.0
P-5242V-12.2.1.4.0
P-5242V-14.1.1.0.0
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2020-14750
Oracle customers with valid support contracts
https://www.oracle.com/security-alerts/alert-cve-2020-14750.html
P-5242V-10.3.6.0.0
P-5242V-12.1.3.0.0
P-5242V-12.2.1.3.0
P-5242V-12.2.1.4.0
P-5242V-14.1.1.0.0