Cyber Resilience

CVE-2020-14883

Oracle Weblogic Server 10.3.6.0.0 … 14.1.1.0.0

CISA KEVActive ExploitationEUVD ExploitedPublic PoC
Published
21 October 2020
Modified
27 October 2025
KEV Added
03 November 2021
Patch / advisory
View advisory
CVSS Score v3.1 7.2
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.98 99.9th percentile
Risk Priority 79 floored blend · peak EPSS

Summary

CVE-2020-14883 is a high-severity an unspecified weakness vulnerability in Oracle Weblogic Server. Its CVSS base score is 7.2 (High).

Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2020-14883 is a vulnerability in the Console component of Oracle WebLogic Server within Oracle Fusion Middleware. It affects supported versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0. The flaw carries a CVSS 3.1 base score of 7.2 with the vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, indicating high impacts to confidentiality, integrity, and availability.

A high-privileged attacker with network access via HTTP can exploit the issue to achieve full takeover of the Oracle WebLogic Server instance. The vulnerability is described as easily exploitable under these conditions.

Oracle's October 2020 Critical Patch Update addresses the flaw, and the references include public exploit code demonstrating remote code execution via the administration console. The vulnerability also appears in CISA's catalog of known exploited vulnerabilities, confirming observed real-world use.

EU & UK References

Vulnerability Data

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle…

more

WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

CWE(s)
NVD-CWE-Other
KEV Date Added
03 November 2021

Related Threats

CVEs Like This One

CVE-2023-21839Same product: Oracle Weblogic Serverboth on KEV
CVE-2024-21182Same product: Oracle Weblogic Serverboth on KEV
CVE-2020-14882Same product: Oracle Weblogic Serverboth on KEV
CVE-2020-2551Same product: Oracle Weblogic Serverboth on KEV
CVE-2020-14750Same product: Oracle Weblogic Serverboth on KEV
CVE-2018-2628Same product: Oracle Weblogic Serverboth on KEV
CVE-2020-2883Same product: Oracle Weblogic Serverboth on KEV
CVE-2020-14644Same product: Oracle Weblogic Serverboth on KEV
CVE-2017-3506Same product: Oracle Weblogic Serverboth on KEV
CVE-2017-10271Same product: Oracle Weblogic Serverboth on KEV

Affected Assets

oracle
weblogic server
10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References