CVE-2021-1996 - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services)

Back Back to CVE browser

LOW

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services)

Published Jan 20, 2021

2.4

LOW

CVSS 3.1

EPSS 1.26%

Description

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 2.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N).

Affected products

Vendor Oracle Corporation Product WebLogic Server Default
n/a
- Version
  10.3.6.0.0
  Status
  affected
  Constraints
  -
- Version
  12.1.3.0.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Oracle Corporation

WebLogic Server

n/a

Version	Status	Constraints
10.3.6.0.0	affected	-
12.1.3.0.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-7460
Advisory
https://www.oracle.com/security-alerts/cpujan2021.html
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-7460		Advisory
https://www.oracle.com/security-alerts/cpujan2021.html		x_refsource_MISCVendor Advisory