The version of WebLogic Server installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2020 CPU advisory.

  - An unspecified vulnerability exists in the Console component. An unauthenticated, remote attacker with     network access via HTTP can exploit this issue to compromise the server. Successful attacks of this     vulnerability can result in takeover of Oracle WebLogic Server. (CVE-2020-14750, CVE-2020-14882)

  - An unspecified vulnerability exists in the Core component. An unauthenticated, remote attacker can exploit     this issue via the IIOP and T3 protocols to compromise the server. Successful attacks of this     vulnerability can result in takeover of Oracle WebLogic Server. (CVE-2020-14859)

  - An unspecified vulnerability exists in the Core component. An unauthenticated, remote attacker can exploit     this issue via the IIOP protocol to compromise the server. Successful attacks of this vulnerability can     result in takeover of Oracle WebLogic Server. (CVE-2020-14841)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle WebLogic Server Multiple Vulnerabilities (Oct 2020 CPU)

critical Nessus Plugin ID 141807

Version 1.24

Version 1.23

Version 1.22

Version 1.21

Version 1.24 Mar 14, 2024, 3:54 PM Detection Plugin Feed: 202403141554
Version 1.23 Sep 25, 2023, 8:04 PM Detection Plugin Feed: 202309252004
Version 1.22 Jan 24, 2023, 7:02 PM Exploit attributes ("Exploit framework core" set to "True") Plugin Feed: 202301241902
Version 1.21 Dec 6, 2022, 6:53 AM Reference Plugin Feed: 202212060653