CVE-2025-21549

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21549
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.oracle.com/security-alerts/cpujan2025.html
Configurations

No configuration.

History

13 Mar 2025, 19:15

Type Values Removed Values Added
CWE CWE-400

18 Feb 2025, 21:15

Type Values Removed Values Added
CWE CWE-770

22 Jan 2025, 18:15

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad en el producto Oracle WebLogic Server de Oracle Fusion Middleware (componente: Core). La versión compatible afectada es la 14.1.1.0.0. Esta vulnerabilidad, que se puede explotar fácilmente, permite que un atacante no autenticado con acceso a la red a través de HTTP/2 ponga en peligro Oracle WebLogic Server. Los ataques exitosos de esta vulnerabilidad pueden dar como resultado la capacidad no autorizada de provocar un bloqueo o un bloqueo frecuente y repetitivo (DOS completo) de Oracle WebLogic Server. Puntuación base de CVSS 3.1: 7,5 (impactos en la disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CWE CWE-770

21 Jan 2025, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-21 21:15

Updated : 2025-03-13 19:15

NVD link : CVE-2025-21549

Mitre link : CVE-2025-21549

CVE.ORG link : CVE-2025-21549

JSON object : View

Products Affected

No product.

CWE
CWE-400

Uncontrolled Resource Consumption