7.5
HIGH
CVE-2024-21182
Oracle WebLogic Server Remote Unauthorized Access Vulnerability
Description

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

INFO

Published Date :

July 16, 2024, 11:15 p.m.

Last Modified :

Nov. 21, 2024, 8:53 a.m.

Source :

[email protected]

Remotely Exploitable :

Yes !

Impact Score :

3.6

Exploitability Score :

3.9
Public PoC/Exploit Available at Github

CVE-2024-21182 has a 3 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2024-21182 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Oracle weblogic_server
: Total Affected Vendor : 1 | Products : 1
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2024-21182.

URL Resource
https://www.oracle.com/security-alerts/cpujul2024.html Vendor Advisory
https://www.oracle.com/security-alerts/cpujul2024.html Vendor Advisory

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
kursadalsan/CVE-2024-21182

PoC for CVE-2024-21182

Java

Updated: 2 weeks, 1 day ago
1 stars 8 fork 8 watcher
Born at : Dec. 29, 2024, 6:45 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
k4it0k1d/CVE-2024-21182

PoC for CVE-2024-21182

Java

Updated: 3 weeks, 1 day ago
19 stars 4 fork 4 watcher
Born at : Dec. 29, 2024, 3:48 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
yulate/yulate

None

Updated: 1 month, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : Nov. 25, 2024, 2:39 p.m. This repo has been linked 4 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2024-21182 vulnerability anywhere in the article.

  • TheCyberThrone
Moxa Routers was affected by critical vulnerabilities

IntroductionIn the realm of cybersecurity, vulnerabilities in network devices can have severe consequences, potentially exposing systems to unauthorized access and malicious attacks. Two critical vuln ... Read more

Published Date: Jan 08, 2025 (1 week, 6 days ago)
CVE-2024-51741 CVE-2024-46981 CVE-2024-10957 CVE-2024-9140 CVE-2024-9138 CVE-2024-43405 CVE-2024-21182
  • TheCyberThrone
CISA KEV UPDATE Part I – January 2025

The US CISA has added 3  vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on the evidence of active exploitation.CVE-2024-41713: Mitel MiCollab Path Traversal VulnerabilityDe ... Read more

Published Date: Jan 08, 2025 (2 weeks ago)
CVE-2024-51741 CVE-2024-46981 CVE-2024-10957 CVE-2024-54677 CVE-2024-50379 CVE-2024-55550 CVE-2024-41713 CVE-2024-43405 CVE-2024-21182 CVE-2020-2883
  • TheCyberThrone
Redis was affected by CVE-2024-51741 and CVE-2024-46981

CVE-2024-51741Description:This vulnerability affects Redis, an open-source in-memory data structure store used as a database, cache, and message broker. The issue arises when an authenticated user wit ... Read more

Published Date: Jan 07, 2025 (2 weeks ago)
CVE-2024-51741 CVE-2024-46981 CVE-2024-10957 CVE-2024-12108 CVE-2024-49113 CVE-2024-43405 CVE-2024-21182
  • TheCyberThrone
TheCyberThrone Security Weekly Review – January 04, 2025

Welcome to TheCyberThrone cybersecurity week in review will be posted covering the important security happenings. This review is for the week ending Saturday, January 04, 2025.CVE-2024-56512 impacts A ... Read more

Published Date: Jan 05, 2025 (2 weeks, 2 days ago)
CVE-2024-11944 CVE-2024-56512 CVE-2024-45387 CVE-2024-49113 CVE-2024-49112 CVE-2024-21182
  • TheCyberThrone
CVE-2024-11944: TrueNAS CORE has Severe Directory Traversal Flaw

CVE-2024-11944 is a vulnerability identified in iXsystems TrueNAS CORE. This vulnerability is classified as a Directory Traversal and Remote Code Execution (RCE) flaw. The exploitation of this vulnera ... Read more

Published Date: Jan 04, 2025 (2 weeks, 3 days ago)
CVE-2024-12108 CVE-2024-11944 CVE-2024-49113 CVE-2024-49112 CVE-2024-21182
  • TheCyberThrone
CVE-2024-49113: PoC Exploit Code Released

The CVE-2024-49113 vulnerability is a significant Denial of Service (DoS) issue found in the Windows Lightweight Directory Access Protocol (LDAP). SafeBreach Labs developed the exploit code, which has ... Read more

Published Date: Jan 03, 2025 (2 weeks, 4 days ago)
CVE-2024-12108 CVE-2024-12987 CVE-2024-49113 CVE-2024-49112 CVE-2024-21182
  • TheCyberThrone
CVE-2024-12108: Progress WhatsUp Gold Vulnerability

CVE-2024-12108 with a CVSS score of 9.6 is a critical security vulnerability affecting WhatsUp Gold, a network monitoring software developed by Progress Software Corporation.Affected VersionsThe vulne ... Read more

Published Date: Jan 02, 2025 (2 weeks, 5 days ago)
CVE-2024-12108 CVE-2024-12987 CVE-2024-49112 CVE-2024-21182
  • TheCyberThrone
CVE-2024-49112 POC Code Released

The CVE-2024-49112 vulnerability, identified as LDAPNightmare, has seen the release of a Proof-of-Concept (PoC) code by SafeBreach Labs. This particular security flaw is critical as it affects the Win ... Read more

Published Date: Jan 02, 2025 (2 weeks, 5 days ago)
CVE-2024-12987 CVE-2024-49112 CVE-2024-21182
  • Cybersecurity News
CVE-2024-21182: PoC Exploit Code Published for Severe WebLogic Flaw

A security researcher published a proof-of-concept (PoC) exploit for CVE-2024-21182, a critical vulnerability in Oracle WebLogic Server. Rated at CVSS 7.5, this flaw exposes affected systems to potent ... Read more

Published Date: Jan 01, 2025 (3 weeks ago)
CVE-2024-38819 CVE-2024-47578 CVE-2024-52544 CVE-2024-21216 CVE-2024-21182 CVE-2021-44207 CVE-2014-2120
  • TheCyberThrone
CVE-2024-21182: Oracle WebLogic Server Flaw Exploit Code Released

CVE-2024-21182 is a high-severity vulnerability identified in Oracle WebLogic Server. This security flaw affects specific versions of the software, namely Oracle WebLogic Server 12.2.1.4.0 and 14.1.1. ... Read more

Published Date: Dec 31, 2024 (3 weeks ago)
CVE-2024-56512 CVE-2024-3393 CVE-2024-45387 CVE-2024-21182

The following table lists the changes that have been made to the CVE-2024-21182 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 21, 2024

    Action Type Old Value New Value
    Added Reference https://www.oracle.com/security-alerts/cpujul2024.html
  • Initial Analysis by [email protected]

    Jul. 19, 2024

    Action Type Old Value New Value
    Changed Reference Type https://www.oracle.com/security-alerts/cpujul2024.html No Types Assigned https://www.oracle.com/security-alerts/cpujul2024.html Vendor Advisory
    Added CWE NIST NVD-CWE-noinfo
    Added CPE Configuration OR *cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
  • CVE Received by [email protected]

    Jul. 16, 2024

    Action Type Old Value New Value
    Added Description Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
    Added Reference Oracle https://www.oracle.com/security-alerts/cpujul2024.html [No types assigned]
    Added CVSS V3.1 Oracle AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2024-21182 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2024-21182 weaknesses.

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
: