WebLogic Server leaks data exploited in wild (CVE-2024-21182) [PoC]
CVE-2024-21182
CVE-2024-21182: Oracle WebLogic Server 12.2.1.4.0 & 14.1.1.0.0 vulnerability leaking critical data. Actively exploited. Apply Oracle security patch immediately.
Actively exploited in the wild - CVE-2024-21182 is a high-severity vulnerability in Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 that lets unauthenticated attackers steal critical data from the server. Exploitation is confirmed; apply Oracle’s April 2024 Critical Patch Update immediately.
Overview
CVE-2024-21182 affects the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. This vulnerability allows an unauthenticated attacker with network access via the T3 or IIOP protocols to compromise the server. Successful exploitation results in unauthorized access to critical data or complete access to all data accessible by WebLogic Server.
The vulnerability carries a CVSS 3.1 base score of 7.5 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. This means the attack requires no authentication, no user interaction, and can be executed over the network with low complexity. The impact is exclusively on confidentiality - the attacker gains read access to sensitive data but cannot modify or destroy it.
Exploitation and Urgency
CISA has confirmed this vulnerability is actively exploited in the wild, placing it on the Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is 87.7%, indicating a very high probability of exploitation within the next 30 days. Organizations should treat this as an urgent patching priority.
Affected Versions
- Oracle WebLogic Server 12.2.1.4.0
- Oracle WebLogic Server 14.1.1.0.0
Remediation
Apply the Oracle Critical Patch Update (CPU) for April 2024. Oracle has released patches for both affected versions. No workarounds are available - patching is the only complete mitigation.
Immediate Actions
- Identify all instances of Oracle WebLogic Server in your environment running the affected versions.
- Apply the April 2024 CPU patches to all affected instances.
- If immediate patching is not possible, restrict network access to the T3 and IIOP ports (typically 7001 and 7002) to only trusted IP addresses.
- Monitor for signs of data exfiltration from WebLogic Server systems.
Security Insight
This vulnerability exemplifies a persistent pattern: Oracle Fusion Middleware products remain a high-value target for threat actors due to their widespread deployment in enterprise environments and the critical data they handle. The fact that an unauthenticated, low-complexity attack can yield complete data access speaks to the challenge of securing legacy enterprise Java stacks. The active exploitation and high EPSS score confirm that attackers are weaponizing these flaws rapidly after patch release, compressing the remediation window for defenders.
Further Reading
Never miss a critical vulnerability
Get real-time security alerts delivered to your preferred platform.
Public PoC References
Unverified third-party code
These repositories are publicly listed on GitHub and have not been audited by Yazoul Security. They may contain malware, backdoors, destructive payloads, or operational security risks (telemetry, exfiltration). Treat them as hostile binaries. Inspect source before execution. Run only in isolated, disposable lab environments (offline VM, no credentials, no production data).
Authorized use only. This information is provided for defensive research, detection engineering, and patch validation. Using exploit code against systems you do not own or do not have explicit written permission to test is illegal in most jurisdictions and violates Yazoul's terms of use.
| Repository | Stars |
|---|---|
| kursadalsan/CVE-2024-21182 PoC for CVE-2024-21182 | ★ 2 |
| k4it0k1d/CVE-2024-21182 PoC for CVE-2024-21182 | ★ 1 |
Showing 2 of 2 known references. Source: nomi-sec/PoC-in-GitHub.
Related Advisories
In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. Us...
Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally....
Microsoft Defender Denial of Service Vulnerability...
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network....