Skip to main content
IMMUNITYSEC

CVE-2020-14883

7.2
HIGH
CVSS 3.1
EPSS 97.9% · 100th pctCISA KEV · Exploited in the wild
2020-10-21•Updated 2026-01-12•KEV 2021-11-03
CISA Known Exploited Vulnerabilities

Oracle WebLogic Server Unspecified Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV
2021-11-03
Remediation due
2022-05-03

Required action
Apply updates per vendor instructions.

CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2020-14883

Description

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Severity

CVSS 3.1 · CNA7.2 HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
SSVC · CISA-ADP
Exploitationactive
Automatableno
Technical impacttotal

Affected Products

VendorProductAffected versions
Oracle CorporationWebLogic Server
10.3.6.0.0
12.1.3.0.0
12.2.1.3.0
12.2.1.4.0
14.1.1.0.0

References

2 Links

Record Details

Published
2020-10-21
Last updated
2026-01-12
Assigner (CNA)
oracle
Credited to
-

More from Oracle Corporation

CVE-2020-148829.8

Oracle WebLogic Server Remote Code Execution Vulnerability

CVE-2017-102717.5

Oracle Corporation WebLogic Server Remote Code Execution Vulnerability

CVE-2019-27257.5

Oracle WebLogic Server, Injection

CVE-2018-26289.8

Oracle WebLogic Server Unspecified Vulnerability

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.