Voidfyoo

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 10.3.6.0.0 through 14.1.1.0.0 **Description** The issue is related to a vulnerability in the Oracle WebLogic Server product, specifically in the Console component. This vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the Oracle WebLogic Server, potentially resulting in a takeover. The vulnerability is easily exploitable and can impact the confidentiality, integrity, and availability of the server. It is associated with errors in code generation management and can be exploited using HTTP requests. **Recommendations** For versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0, update to a version that includes the emergency patch released by Oracle to fix this critical flaw. As a temporary workaround, consider restricting access to the Console component until a patch is applied. Avoid using the vulnerable Console component in the affected Oracle WebLogic Server versions until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 10.3.6.0.0 through 14.1.1.0.0 **Description** A vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console) allows an unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. The flaw is under active attack, and researchers warn that it has been exploited in real-world incidents. The vulnerability can be exploited using a single GET request. **Recommendations** For Oracle WebLogic Server versions 10.3.6.0.0 through 14.1.1.0.0, apply the official fix from Oracle to patch the vulnerability. As a temporary workaround, consider restricting access to the Console component of the WebLogic Server to minimize the risk of exploitation. Additionally, monitor your system for any suspicious activity and consider implementing additional security measures to prevent exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 10.3.6.0.0 through 14.1.1.0.0 **Description** The issue is related to insufficient input validation in the Console component of Oracle WebLogic Server, allowing a remote attacker to gain full control over the application via the HTTP protocol. The 8220 Gang has been observed exploiting this flaw to spread malware, including infostealers and cryptominers, in various sectors such as healthcare, telecom, and finance. Successful attacks can result in the takeover of Oracle WebLogic Server. **Recommendations** For Oracle WebLogic Server versions 10.3.6.0.0 through 14.1.1.0.0, update to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting access to the Console component to minimize the risk of exploitation. Additionally, monitor for suspicious activity and apply security patches as soon as they become available.