Cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aoracleweblogic_server12.2.1.3.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 02 Sep 2026 12:43:23 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOracle WebLogic Server Improper Access Control Vulnerability (CVE-2023-21839)https://feed.craftedsignal.io/briefs/2026-09-cve-2023-21839/Wed, 02 Sep 2026 12:43:23 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-cve-2023-21839/CVE-2023-21839 is an improper access control vulnerability in Oracle WebLogic Server enabling unauthorized remote JNDI lookups via T3 or IIOP protocols, with multiple functional proof-of-concept exploits now publicly available.CVE-2023-21839 is a high-severity (CVSS 7.5) improper access control vulnerability in Oracle WebLogic Server. The vulnerability allows unauthenticated, remote attackers to trigger unauthorized JNDI lookups by manipulating objects bound via the T3 or IIOP protocols. Specifically, when an attacker triggers a lookup or list operation on a bound object, the system inadvertently invokes the getReferent method of that object. This allows an attacker to direct the server to interact with arbitrary JNDI endpoints, such as malicious LDAP servers, which can be leveraged for further exploitation. The recent publication of functional proof-of-concept exploits and scanning tools on public repositories significantly elevates the risk for organizations running affected versions (12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0). Defenders should prioritize patching and monitoring network traffic for anomalous T3/IIOP interactions.

Attack Chain

  1. Attacker identifies an internet-exposed Oracle WebLogic Server instance using the T3 or IIOP protocol.
  2. Attacker interacts with the WebLogic RMI/CORBA interface to bind a malicious or specifically crafted object to the naming service.
  3. Attacker triggers a JNDI lookup or list operation targeting the previously bound object.
  4. The WebLogic server processes the request, traversing the WLNamingManager and BasicNamingNode components.
  5. The application code executes the vulnerable getReferent method on the crafted object due to insufficient access controls.
  6. The server initiates a network connection to an attacker-controlled remote server (e.g., via ldap://) as specified in the JNDI lookup.
  7. The external server provides a malicious payload or response to the WebLogic server, potentially leading to further exploitation or unauthorized data access.

Impact

The vulnerability allows unauthenticated remote attackers to perform unauthorized JNDI operations against Oracle WebLogic Server. If successful, this can lead to unauthorized information disclosure or serve as an initial vector for more complex attacks, including remote code execution depending on the subsequent JNDI response handling. With multiple functional exploits now publicly available, the risk to unpatched enterprise infrastructure is high.

Recommendation

  1. Apply the latest security patches for Oracle WebLogic Server provided by Oracle immediately to remediate CVE-2023-21839.
  2. Implement strict network segmentation and access control lists (ACLs) to limit access to T3 and IIOP ports (typically 7001) to known and authorized source IP addresses only.
  3. Configure WebLogic security policies to disable or restrict the use of JNDI lookups from untrusted sources.
  4. Monitor network traffic for anomalous outbound connections originating from WebLogic application servers to external/unknown IP addresses, particularly over non-standard or LDAP-related ports.
  5. Audit application logs for javax.naming.InitialContext lookup errors or unusual JNDI activity patterns associated with RMI/IIOP services.
]]>highadvisory