CVE-2022-21453: 
Oracle WebLogic Server vulnerability analysis and mitigation

A vulnerability exists in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). The affected versions include 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0. This vulnerability allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server, requiring human interaction from a person other than the attacker (Oracle Advisory).

The vulnerability has been assigned a CVSS 3.1 Base Score of 6.1 (Medium) with the vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability requires network access and user interaction, with potential scope change that could impact additional products beyond WebLogic Server (NVD).

Successful exploitation of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data, as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data. The scope change indicates that attacks may significantly impact additional products beyond WebLogic Server (Oracle Advisory).

Oracle has released patches to address this vulnerability as part of the April 2022 Critical Patch Update. Organizations running affected versions of WebLogic Server (12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0) should apply the security patches without delay (Oracle Advisory).