CVE-2021-2294: 
Oracle WebLogic Server vulnerability analysis and mitigation

Vulnerability in Oracle WebLogic Server Core component affects versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0. This is an easily exploitable vulnerability that allows unauthenticated attackers with network access via T3 or IIOP protocols to compromise Oracle WebLogic Server (Oracle Advisory).

The vulnerability has a CVSS Base Score of 6.5 (Medium) with CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. The vulnerability can be exploited remotely without authentication through network access (NVD).

Successful exploitation can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data. Additionally, attackers can cause a partial denial of service (partial DOS) of Oracle WebLogic Server (NVD).

The vulnerability is easily exploitable by unauthenticated attackers with network access via T3 and IIOP protocols. Multiple security researchers have identified this vulnerability including researchers from Cloud-Penetrating Arrow Lab, Knownsec 404 Team, and MoyunSec V-Lab (Oracle Advisory).

Oracle released security patches for this vulnerability as part of the April 2021 Critical Patch Update. Affected customers should apply the security patches to the supported versions: 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 (Oracle Advisory).