{"id":"CVE-2022-21371","published":"2022-01-19T11:26:00Z","modified":"2024-09-24T20:18:10Z","title":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container)","vendor":"Oracle Corporation","product":"WebLogic Server","tier":"core","eol":null,"affectedVersions":[{"vendor":"Oracle Corporation","product":"WebLogic Server","versions":["12.1.3.0.0","12.2.1.3.0","12.2.1.4.0","14.1.1.0.0"]}],"description":{"text":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","provenance":"source","from":"CVE.org"},"summary":{"text":"A flaw in the Web Container component of Oracle WebLogic Server, part of Oracle Fusion Middleware, affects the 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 releases. An unauthenticated attacker with network access over HTTP can gain unauthorized access to critical data, or to all data accessible to WebLogic Server, with no user interaction or special configuration required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:12:43Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.92649,"percentile":0.99827,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2022-08-19","exploitedFirstSeen":"2022-08-19","ransomware":false,"evidence":[{"url":"https://unit42.paloaltonetworks.com/recent-exploits-network-security-trends/","date":"2022-08-19"},{"url":"https://go.catonetworks.com/rs/245-RJK-441/images/CATO-NETWORKS-THREAT-REPORT2024.pdf","date":"2024-05-07"},{"url":"https://go.catonetworks.com/rs/245-RJK-441/images/Q2_24_Cato_CTRL_Threat_Report.pdf","date":"2024-08-13"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":null,"cwes":[],"references":[{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/165736/Oracle-WebLogic-Server-14.1.1.0.0-Local-File-Inclusion.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-26595","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-26595","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":50688,"url":"https://www.exploit-db.com/exploits/50688","title":"Oracle WebLogic Server 14.1.1.0.0 - Local File Inclusion","type":"remote","platform":"windows","date":"2022-01-27","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2022-01-27"},"pocGithub":{"count":3,"skipped":0,"earliest":"2022-01-25","earliestUrl":"https://github.com/Mr-xn/CVE-2022-21371","repos":[{"name":"Mr-xn/CVE-2022-21371","url":"https://github.com/Mr-xn/CVE-2022-21371","stars":26,"created":"2022-01-25"},{"name":"Vulnmachines/Oracle-WebLogic-CVE-2022-21371","url":"https://github.com/Vulnmachines/Oracle-WebLogic-CVE-2022-21371","stars":18,"created":"2022-08-25"},{"name":"Cappricio-Securities/CVE-2022-21371","url":"https://github.com/Cappricio-Securities/CVE-2022-21371","stars":1,"created":"2024-06-05"}]},"nuclei":[{"id":"CVE-2022-21371","name":"Oracle WebLogic Server Local File Inclusion","severity":"high","path":"http/cves/2022/CVE-2022-21371.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-21371.yaml"}],"first":{"date":"2022-01-25","source":"PoC-in-GitHub","url":"https://github.com/Mr-xn/CVE-2022-21371"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/165736/Oracle-WebLogic-Server-14.1.1.0.0-Local-File-Inclusion.html"],"flow":[],"timeline":[{"date":"2022-01-19","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-21371","provenance":"source"},{"date":"2022-01-25","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2022-01-27","url":"https://github.com/Mr-xn/CVE-2022-21371","provenance":"source"},{"date":"2022-08-19","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://unit42.paloaltonetworks.com/recent-exploits-network-security-trends/","provenance":"source"}],"speed":{"daysToPublicExploit":6,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":65.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1535 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9983"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 NVD exploit link; 3 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}