$ cve CVE-2022-21371 JSON

CVE-2022-21371 EXPLOIT

7.5

HIGH · CVSS 3.1 · EPSS 92.6% (pctl 100)

Patch early

A public exploit exists.

Description

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Scoring

CVSS	7.5 (HIGH, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS	92.65% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-22
On CISA KEV	no
Public exploit	yes
Published	2022-01-19
Last modified	2026-06-17

Affected (1)

Vendor	Product
oracle	weblogic server

Public exploits

Source	Title	Date
exploit-db	Oracle WebLogic Server 14.1.1.0.0 - Local File Inclusion	2022-01-27

References

→ the Explorer · watch your stack · NVD