CVE-2020-14750
Oracle WebLogic Server Remote Code Execution Vulnerability
Description
CVE-2020-14750 is a critical-severity remote code execution vulnerability in Oracle WebLogic Server, a component of Oracle Fusion Middleware. This vulnerability allows an unauthenticated attacker with network access via HTTP to completely take over the affected WebLogic Server. The vulnerability is related to CVE-2020-14882, which targets the same WebLogic Console component, and represents an authentication bypass that can be chained for full system compromise. Affected versions include Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0. CISA has confirmed active exploitation through its KEV catalog, and with an EPSS score of 94.44% (99.99th percentile), CVE-2020-14750 has one of the highest exploitation probabilities of any tracked vulnerability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| oracle | weblogic server | 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0 |
References
- http://packetstormsecurity.com/files/160143/Oracle-WebLogic-Server-Administration-Console-Handle-Remote-Code-Execution.html(Third Party Advisory, VDB Entry)
- https://www.oracle.com/security-alerts/alert-cve-2020-14750.html(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-14750(US Government Resource)
Weakness Type
NVD-CWE-noinfo: Insufficient Information
The specific weakness type for CVE-2020-14750 has not been formally classified by NVD. However, the vulnerability involves an authentication bypass in the Oracle WebLogic Server Console component that allows unauthenticated remote attackers to access administrative functionality via specially crafted HTTP requests. This vulnerability is closely related to CVE-2020-14882 and represents an incomplete fix or bypass of that vulnerability's patch.
Learn more: NVD CWE Classification
Impact Analysis
CVE-2020-14750 carries a CVSS 3.1 score of 9.8 (CRITICAL), reflecting the maximum exploitability and severe impact potential. The vulnerability is remotely exploitable over the network via HTTP without physical access, requires low attack complexity with no special conditions needed, and demands no authentication or user interaction to trigger. Confidentiality (High): An attacker gains full read access to all data managed by the WebLogic Server, including deployed applications, database connection pools, and JNDI-stored credentials. Integrity (High): Successful exploitation enables arbitrary code execution, allowing attackers to deploy malicious applications, modify server configurations, or establish persistent access. Availability (High): Complete control over server availability, enabling denial of service or disruption of all deployed enterprise applications. The EPSS score of 94.44% places this vulnerability in the 99.99th percentile, indicating it is among the most actively exploited vulnerabilities globally. When combined with CVE-2020-14882, the attack chain enables complete unauthenticated takeover of WebLogic Server instances.
Exploit Maturity
CVE-2020-14750 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 94.44% (99.99th percentile) places this among the most actively exploited vulnerabilities in existence. A related exploit targeting the WebLogic Server Administration Console is available via Packet Storm Security. This vulnerability is closely related to CVE-2020-14882, and when combined, the two CVEs enable a complete unauthenticated remote code execution chain against the WebLogic Console. Federal agencies were required to remediate this vulnerability by 2022-05-03 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Oracle has released an out-of-band security alert specifically for this vulnerability.
- Verify that all instances of Oracle WebLogic Server (versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0) have been updated to patched versions. Also ensure that the related CVE-2020-14882 patch has been applied, as both vulnerabilities target the Console component.
- Restrict network access to the WebLogic Server Administration Console (typically on port 7001). The Console should never be exposed to the internet. Use firewall rules and network segmentation to limit Console access to trusted administrative networks only.
- Monitor WebLogic Server access logs for suspicious HTTP requests targeting the Console endpoint, particularly those using URL encoding, double encoding, or path traversal techniques to bypass authentication. Review system integrity for unauthorized deployed applications or configuration changes.
- Implement a reverse proxy or Web Application Firewall (WAF) in front of WebLogic Server with rules that inspect and normalize URL paths before forwarding requests. Enable WebLogic Server audit logging to detect unauthorized administrative actions.
Technical Details
CVE-2020-14750 affects the Console component of Oracle WebLogic Server in versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0. The vulnerability allows unauthenticated attackers to bypass authentication controls on the WebLogic Administration Console via specially crafted HTTP requests. This is related to CVE-2020-14882, which was an earlier authentication bypass in the same component, and CVE-2020-14750 effectively represents a way to circumvent the original patch. The attack is executed over HTTP, meaning standard web traffic can carry the exploit payload without triggering typical network-level security controls. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that the vulnerability is trivially exploitable from any network position without credentials, and successful exploitation results in complete takeover of the WebLogic Server instance with full impact on confidentiality, integrity, and availability.
Frequently Asked Questions
Is CVE-2020-14750 being actively exploited?
Yes. CVE-2020-14750 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 94.44% (99.99th percentile) indicates it is among the most actively exploited vulnerabilities globally. No known ransomware campaigns are currently associated with this specific vulnerability.
What products are affected by CVE-2020-14750?
CVE-2020-14750 affects Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0. The vulnerability targets the WebLogic Server Console component.
How do I fix CVE-2020-14750?
Apply Oracle's security alert patch for CVE-2020-14750 immediately. Update all WebLogic Server instances to the latest patched versions. Ensure both CVE-2020-14750 and the related CVE-2020-14882 patches are applied. Restrict access to the WebLogic Administration Console to trusted internal networks only.
How severe is CVE-2020-14750?
CVE-2020-14750 has a CVSS 3.1 score of 9.8 (CRITICAL). With an EPSS score in the 99.99th percentile, it is one of the most actively exploited vulnerabilities tracked. Combined with CVE-2020-14882, it enables complete unauthenticated remote code execution against WebLogic Server, requiring immediate remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.