CVE-2023-22040: 
Oracle WebLogic Server vulnerability analysis and mitigation

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core) affects versions 12.2.1.4.0 and 14.1.1.0.0. This is an easily exploitable vulnerability that allows high privileged attackers with network access via multiple protocols to compromise Oracle WebLogic Server (Oracle CPU Jul 2023).

The vulnerability has been assigned a CVSS 3.1 Base Score of 6.5, indicating MEDIUM severity. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H, which indicates network attack vector, low attack complexity, requires high privileges, no user interaction, and affects only the vulnerable component with high impacts to integrity and availability but no impact to confidentiality (NVD).

Successful exploitation can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data. Additionally, attackers can gain unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server (Oracle CPU Jul 2023).

Oracle strongly recommends that customers apply Critical Patch Update security patches as soon as possible. The vulnerability has been patched in the July 2023 Critical Patch Update (Oracle CPU Jul 2023).

The vulnerability was discovered and reported by Sven Woynoski of it.sec GmbH (Oracle CPU Jul 2023).