CVE-2020-14883

Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server versions 10.3.6.0.0 through 14.1.1.0.0

Description The issue is related to insufficient input validation in the Console component of Oracle WebLogic Server, allowing a remote attacker to gain full control over the application via the HTTP protocol. The 8220 Gang has been observed exploiting this flaw to spread malware, including infostealers and cryptominers, in various sectors such as healthcare, telecom, and finance. Successful attacks can result in the takeover of Oracle WebLogic Server.

Recommendations For Oracle WebLogic Server versions 10.3.6.0.0 through 14.1.1.0.0, update to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting access to the Console component to minimize the risk of exploitation. Additionally, monitor for suspicious activity and apply security patches as soon as they become available.