CVE-2021-2394

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Jul 21, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-23958.1Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (component: iCare, Configur CVE-2021-239534.3If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin information, when said informa CVE-2021-239548.8Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading to a memory corrupti CVE-2021-239556.1The browser could have been confused into transferring a pointer lock state into another tab, which could have lead to clickjacking attacks.CVE-2021-239566.5An ambiguous file picker design could have confused users who intended to select and upload a single file into uploading a whole directory. CVE-2021-239577.4Navigations through the Android-specific `intent` URL scheme could have been misused to escape iframe sandbox. Note: This issue only affecte CVE-2021-239586.5The browser could have been confused into transferring a screen sharing state into another tab, which would leak unintended information. Thi CVE-2021-239596.1An XSS bug in internal error pages could have led to various spoofing attacks, including other error pages and the address bar. Note: This i CVE-2021-23968.8Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO). Supported versions that ar CVE-2021-239608.8Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash. This CVE-2021-239617.4Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hos CVE-2021-239628.8Incorrect use of the '<RowCountChanged>' method could have led to a user-after-poison and a potentially exploitable crash. This vulnerabilit