Stefano Ciccone

The issue is related to insufficient access control in the WLS Core Components of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via the IIOP protocol to compromise the server. Successful attacks can result in the takeover of Oracle WebLogic Server.

The issue concerns malicious EL expressions in view states that process form submissions. This can affect applications that do not change the value of the `useSpringBinding` property, which is disabled by default.