CVE-2020-14882 PoC — Oracle WebLogic Server 安全漏洞

Source

https://github.com/N0Coriander/CVE-2020-14882-14883

Associated Vulnerability

Title: Oracle WebLogic Server 安全漏洞 (CVE-2020-14882)
Description:Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Description

结合14882的未授权访问漏洞，通过14883可远程执行任意代码

Readme

# CVE-2020-14882&14883
> Weblogic是Oracle公司推出的J2EE应用服务器，`CVE-2020-14882 是一个 Console 的未授权访问漏洞`，漏洞等级被评为`严重`，漏洞评分：`9.8`。而 `CVE-2020-14883 是在利用未授权访问的前提下，在 Console 进行代码执行`，于是远程攻击者可以构造特殊的 HTTP 请求，在未经身份验证的情况下接管 WebLogic Server Console ，并在 WebLogic Server Console 中执行任意代码。

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →