{"id":"CVE-2020-14883","kind":"vulnerability","aliases":["CVE-2020-14883"],"related":[],"title":"Oracle WebLogic Server: Oracle WebLogic Server Unspecified Vulnerability","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle WebLogic Server has an unspecified flaw in its Console component that gives high impact to confidentiality, integrity and availability. CISA lists it as known exploited, and the EPSS exploitation score is 0.977.","severity":"critical","cvss":9.0,"epss":0.97734,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Oracle WebLogic Server","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","java","oracle","runtime","self-hosted","weblogic"],"not_affected_if":["default-config"],"how_to_check":null,"fix":"Apply the Oracle security update for WebLogic Server per vendor instructions; the sources do not name the patched version.","status":"open","published_at":"2020-10-21T15:15:25+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:41:45+00:00","updated_at":"2026-10-23T21:57:34+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-23T21:41:45Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Oracle security update for WebLogic Server per vendor instructions; the sources do not name the patched version.","reach":"network","impact":"high","summary":"Oracle WebLogic Server has an unspecified flaw in its Console component that gives high impact to confidentiality, integrity and availability. CISA lists it as known exploited, and the EPSS exploitation score is 0.977.","category":"runtime","who_cares":["weblogic","java","self-hosted","oracle"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker gets high confidentiality, integrity and availability impact on the server.","analyst_note":"Find the Oracle Critical Patch Update advisory for CVE-2020-14883 to get affected and fixed versions, the exact Console endpoint, and whether authentication is needed.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000464,"input_tokens":2833,"output_tokens":361,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the Oracle Critical Patch Update advisory for CVE-2020-14883 to get affected and fixed versions, the exact Console endpoint, and whether authentication is needed.","search":"'-14883':11A,14A '-2020':10A,13A '/av':128C '0.977':58B '10.3.6.0.0':78C '12.1.3.0.0':79C '12.2.1.3.0':80C '12.2.1.4.0':81C '14.1.1.0.0':83C '3.1':115C,127C '7.2':118C 'access':93C 'affect':76C 'allow':87C 'attack':90C,102C 'avail':45B,122C 'base':116C 'cisa':46B 'compon':36B,70C 'compromis':97C 'confidenti':42B,119C 'consol':35B,71C 'cve':9A,12A 'cvss':114C,124C,126C 'easili':84C 'epss':54B 'exploit':18B,51B,55B,85C 'flaw':32B 'fusion':68C 'give':38B 'h':136C 'h/a':135C 'h/i':134C 'h/ui':131C 'high':39B,88C 'host':24B 'http':95C 'impact':40B,123C 'integr':43B,120C 'java':19B 'known':50B 'l/pr':130C 'list':47B 'middlewar':69C 'n/ac':129C 'n/s':132C 'network':92C 'oracl':1A,4A,20B,26B,62C,67C,98C,111C 'oracle':15A 'privileg':89C 'product':65C 'result':107C 'runtim':21B 'score':56B,117C 'self':23B 'self-host':22B 'server':3A,6A,17A,28B,64C,100C,113C 'success':101C 'support':72C 'takeov':109C 'u/c':133C 'unspecifi':7A,31B 'vector':125C 'version':73C 'via':94C 'vulner':8A,59C,86C,105C 'weblog':2A,5A,25B,27B,63C,99C,112C 'weblogic':16A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-10-21T15:15:25+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-14883","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-14883","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T14:39:41+00:00","note":null},{"source":"epss","external_id":"CVE-2020-14883","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-14883","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-14883","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14883","severity":null,"published_at":"2020-10-21T15:15:25+00:00","modified_at":"2026-06-17T02:55:44+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T21:57:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}