CVE-2020-14572: 
Oracle WebLogic Server vulnerability analysis and mitigation

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console) affects versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. This easily exploitable vulnerability allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker (Oracle Advisory).

The vulnerability has a CVSS 3.1 Base Score of 6.1 (Confidentiality and Integrity impacts) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability affects the Console component of Oracle WebLogic Server and requires network access via HTTP protocol for exploitation (Oracle Advisory).

Successful exploitation can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products (Oracle Advisory).

The vulnerability is considered easily exploitable and requires no privileges (unauthenticated attacker). However, successful exploitation requires human interaction from a person other than the attacker. The attack vector is through network access via HTTP protocol (Oracle Advisory).

Oracle has released patches for affected versions (10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0) as part of the July 2020 Critical Patch Update. Oracle strongly recommends that customers apply Critical Patch Update security patches as soon as possible (Oracle Advisory).