CVE-2021-2075: 
Oracle WebLogic Server vulnerability analysis and mitigation

CVE-2021-2075 is a critical vulnerability affecting Oracle WebLogic Server. The vulnerability was discovered by Codeplutos of AntGroup FG Security Lab and was disclosed in Oracle's January 2021 Critical Patch Update. This vulnerability allows unauthenticated attackers with network access via IIOP or T3 protocols to compromise Oracle WebLogic Server (Oracle CPU Jan 2021).

The vulnerability exists in the Samples component of Oracle WebLogic Server. It affects multiple supported versions of WebLogic Server including 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0. The vulnerability is easily exploitable and can be accessed remotely without authentication (Oracle CPU Jan 2021).

A successful exploitation of this vulnerability can result in a complete compromise of the Oracle WebLogic Server. The attacker could potentially gain unauthorized access to critical data and take control of the affected system (NVD).

The vulnerability is considered easily exploitable by unauthenticated attackers who have network access via IIOP or T3 protocols. No special conditions or user interaction is required for exploitation (NVD).

Oracle released patches for this vulnerability as part of its January 2021 Critical Patch Update. Users are strongly advised to apply these security patches without delay to protect their systems. The patches are available for all affected versions of WebLogic Server (Oracle CPU Jan 2021).