CVE-2019-2441

Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server version 12.2.1.3

Description The issue is related to insufficient access control in the Application Container - JavaEE component of Oracle WebLogic Server, allowing a remote attacker to gain unauthorized access to protected data via the HTTP protocol. This can result in unauthorized read access to a subset of Oracle WebLogic Server accessible data.

Recommendations For version 12.2.1.3, consider restricting access to the Application Container - JavaEE component until a patch is available. As a temporary workaround, limit network access via HTTP to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.