CVE-2020-2798

Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server versions 10.3.6.0.0 through 12.2.1.4.0

Description The issue is related to insufficient access control in the WLS Web Services component of Oracle WebLogic Server, allowing a high-privileged attacker with network access via IIOP, T3 protocols to compromise the server. Successful attacks can result in the takeover of Oracle WebLogic Server.

Recommendations For versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0, consider restricting access to the WLS Web Services component until a patch is available. As a temporary workaround, consider disabling the use of IIOP and T3 protocols to minimize the risk of exploitation. Restrict network access to the Oracle WebLogic Server to minimize the risk of remote attacks.