CVE-2021-2376: High severity oracle weblogic server vulnerability

Published Jul 20, 2021

Updated

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Affected Software

5 affected components

ORACLE WebLogic Server=10.3.6.0.0

ORACLE WebLogic Server=12.1.3.0.0

ORACLE WebLogic Server=12.2.1.3.0

ORACLE WebLogic Server=12.2.1.4.0

ORACLE WebLogic Server=14.1.1.0.0

Event History

Jul 20, 2021

CVE Published

via MITRE·10:43 PM

Data Sourced

via MITRE·10:43 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2021-2376?

CVE-2021-2376 is rated as a critical vulnerability due to its potential for exploitation by unauthenticated attackers.

How do I fix CVE-2021-2376?

To mitigate CVE-2021-2376, apply the latest security patches provided by Oracle for the affected versions of WebLogic Server.

Which versions of Oracle WebLogic Server are affected by CVE-2021-2376?

CVE-2021-2376 affects Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0.

What type of attacks can exploit CVE-2021-2376?

CVE-2021-2376 can be exploited in network-based attacks, allowing unauthorized access to Web Services.

Is authentication required to exploit CVE-2021-2376?

No, CVE-2021-2376 can be exploited by unauthenticated attackers, making it particularly dangerous.