CVE-2021-2108: 
Oracle WebLogic Server vulnerability analysis and mitigation

Easily exploitable vulnerability in Oracle WebLogic Server that allows unauthenticated attackers with network access via IIOP or T3 protocols to compromise the server. This vulnerability was discovered by Yu Wang of BMH Security Team and was disclosed in January 2021 (Oracle Advisory).

The vulnerability has a CVSS Base Score of 8.8, indicating high severity. It affects Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0. The attack vector is through network access, specifically via IIOP (Internet Inter-ORB Protocol) or T3 protocols, and can be exploited without requiring authentication (Oracle Advisory).

A successful exploitation of this vulnerability could lead to a complete compromise of Oracle WebLogic Server, potentially giving attackers full control over the affected system (Oracle Advisory).

The vulnerability is considered easily exploitable by unauthenticated attackers who have network access to the target system through IIOP or T3 protocols (Oracle Advisory).

Oracle strongly recommends that customers apply the Critical Patch Update security patches without delay. The fix for this vulnerability was included in Oracle's January 2021 Critical Patch Update (Oracle Advisory).