CVE-2022-21371
Published: 19 January 2022
Summary
CVE-2022-21371 is a high-severity Path Traversal (CWE-22) vulnerability in Oracle Weblogic Server. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 0.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2022-21371 is a path traversal vulnerability, tracked as CWE-22, in the Web Container component of Oracle WebLogic Server within Oracle Fusion Middleware. It affects supported versions 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0. The flaw carries a CVSS 3.1 base score of 7.5 with a vector indicating network-accessible exploitation without authentication or user interaction, resulting solely in high confidentiality impact.
An unauthenticated attacker with network access via HTTP can exploit the issue to read arbitrary files on the server, achieving unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. Public proof-of-concept code demonstrating local file inclusion against version 14.1.1.0.0 has been published.
The January 2022 Oracle Critical Patch Update addresses the vulnerability for the listed releases and recommends applying the available patches as the primary mitigation. The associated EPSS score has remained high, with a current value of 0.9342 and a peak of 0.9416.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-26595
Vulnerability details
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic…
more
Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.