CVE-2024-21182
Oracle WebLogic Server Unspecified Vulnerability
Description
CVE-2024-21182 is a vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. An unauthenticated attacker with network access via the T3 or IIOP protocols can exploit it to compromise Oracle WebLogic Server and obtain unauthorized access to critical data or to all data accessible to the server. The flaw carries a confidentiality-only impact and is rated HIGH with a CVSS 3.1 base score of 7.5. It matters because CISA has added CVE-2024-21182 to its Known Exploited Vulnerabilities (KEV) catalog, and the EPSS score sits in the 99.58th percentile, indicating near-certain exploitation activity. Organizations running affected versions of Oracle WebLogic Server should treat this as an urgent, actively exploited issue.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| oracle | weblogic server | 12.2.1.4.0; 14.1.1.0.0 |
References
- https://www.oracle.com/security-alerts/cpujul2024.html(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21182(US Government Resource)
Weakness Type
Weakness Type
The NVD record does not assign a specific CWE for CVE-2024-21182. The nature of the issue is an unauthenticated, network-reachable flaw in the WebLogic Server Core component, exploitable over the T3 and IIOP protocols, leading to unauthorized disclosure of sensitive data.
Impact Analysis
The CVSS 3.1 vector reflects a flaw that is remotely exploitable (AV:N), of low attack complexity (AC:L), requires no privileges (PR:N), and needs no user interaction (UI:N), with an unchanged scope (S:U) that keeps impact within the vulnerable component. The impact is Confidentiality (High), meaning an attacker can gain unauthorized access to critical or all WebLogic-accessible data, while Integrity (None) and Availability (None) indicate no direct modification or service disruption. Together these metrics yield a CVSS base score of 7.5 (HIGH). The EPSS score of 0.89649 places this in the 99.58th percentile, signaling near-certain exploitation activity. Given that combination, remediation should be treated as urgent.
Exploit Maturity
CISA has confirmed active exploitation by adding CVE-2024-21182 to its Known Exploited Vulnerabilities (KEV) catalog. The EPSS score of 0.89649 (99.58th percentile) indicates near-certain exploitation activity, placing this among the highest-risk vulnerabilities. The available references contain only the Oracle Critical Patch Update advisory and carry no "Exploit" tag, so no packaged public exploit is linked here, but T3 and IIOP WebLogic flaws are historically weaponized rapidly, so it should be treated as actively exploited and patched immediately. No ransomware association has been recorded for this CVE.
Remediation
- Follow the CISA KEV required action: "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."
- Apply the Oracle Critical Patch Update of July 2024, which provides the fix for the affected versions 12.2.1.4.0 and 14.1.1.0.0; see the Oracle CPU advisory.
- As an interim measure, restrict or disable the T3 and IIOP protocols, or filter them with a connection filter (weblogic.security.net.ConnectionFilterImpl), restrict network access to the WebLogic admin and managed ports to trusted hosts, and place WebLogic behind network segmentation.
- For monitoring, review access logs for anomalous T3 or IIOP connections and unusual data-access patterns.
- For long-term hardening, minimize exposed Fusion Middleware protocols, maintain a least-exposure network posture, and stay current with the quarterly Oracle Critical Patch Updates.
Technical Details
The flaw resides in the WebLogic Server Core component, where an unauthenticated attacker with network access via the T3 or IIOP protocols can exploit it easily to compromise the server and gain unauthorized read access to critical data. The CVSS vector metrics describe network reachability, low attack complexity, no required privileges, no user interaction, an unchanged scope, and a confidentiality-only High impact. Oracle classifies this as an unspecified vulnerability in the Core component with confidentiality impact. The affected supported versions are Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0.
Frequently Asked Questions
Is CVE-2024-21182 being actively exploited?
Yes. CISA has added CVE-2024-21182 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation, and the EPSS score of 0.89649 (99.58th percentile) indicates near-certain exploitation activity. No ransomware association has been recorded.
What products are affected by CVE-2024-21182?
Oracle WebLogic Server (Oracle Fusion Middleware, Core component), specifically the supported versions 12.2.1.4.0 and 14.1.1.0.0.
How do I fix CVE-2024-21182?
Apply the Oracle Critical Patch Update of July 2024 for the affected versions. As interim mitigation, restrict or disable the T3 and IIOP protocols or filter them with a connection filter, limit network access to the WebLogic ports to trusted hosts, and follow the CISA KEV guidance.
How severe is CVE-2024-21182?
It is rated HIGH with a CVSS 3.1 base score of 7.5. The impact is confidentiality-only (unauthorized access to critical or all WebLogic-accessible data), with no integrity or availability impact, but KEV listing and a 99.58th percentile EPSS score make it urgent.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.