CVE-2024-20931

What it actually does

CVE-2024-20931 is an unauthenticated, network-reachable information disclosure vulnerability in Oracle WebLogic Server Core affecting supported 12.2.1.4.0 and 14.1.1.0.0 releases. An attacker who can reach the WebLogic T3 or IIOP listener can trigger the flaw without credentials or user interaction and obtain unauthorized access to sensitive data exposed through the WebLogic Server process or data accessible to it. The CVSS vector indicates high confidentiality impact with no integrity or availability impact, meaning the primary risk is disclosure of critical application, session, configuration, or server-accessible data rather than code execution or service disruption.

Why it matters to the business

A vulnerable WebLogic Server exposed to untrusted networks can leak sensitive business data without requiring a valid account. For organizations running WebLogic-hosted applications, this may result in disclosure of customer, employee, application, or integration data, create regulatory notification obligations, and provide attackers with information useful for follow-on compromise. The EPSS score is high, indicating meaningful likelihood of exploitation activity, even though this issue is not currently listed in CISA KEV and no ransomware-specific use is indicated in the supplied data.

How an attack unfolds

An attacker first identifies an Oracle WebLogic Server instance with T3 or IIOP reachable over the network, commonly on WebLogic listen ports such as 7001 or 7002, though deployments may use custom ports. The attacker then sends crafted protocol traffic to the T3 or IIOP endpoint. Because exploitation requires no authentication and no user interaction, any reachable vulnerable listener can be targeted directly. If the server is running an affected, unpatched version, the crafted interaction can cause WebLogic Core to disclose data that should not be available to the attacker. The disclosed information may be valuable on its own or may support additional attacks against applications, credentials, integrations, or administrative interfaces hosted on the same platform.

How to fix it

Apply the Oracle Critical Patch Update that fixes CVE-2024-20931 for Oracle WebLogic Server, or a later supported CPU/PSU for the affected branch. Because no exact fixed version was provided in the input, administrators should verify remediation against Oracle’s official advisory for the installed WebLogic release and ensure both 12.2.1.4.0 and 14.1.1.0.0 deployments have the applicable patch level installed. Where immediate patching is not possible, restrict T3 and IIOP exposure to trusted application tiers only, block internet access to WebLogic listen ports, disable unused protocols where operationally feasible, enforce network allowlisting between application components, and place administrative and application endpoints behind controlled ingress. Treat network controls as temporary risk reduction, not a substitute for patching.

How to confirm the fix worked

Confirm the installed WebLogic Server version and patch inventory using Oracle OPatch, WebLogic Server version output, and Oracle inventory records, then compare the result with Oracle’s advisory for CVE-2024-20931. Validate that all managed servers, AdminServer nodes, clustered nodes, container images, golden images, and disaster-recovery instances are patched consistently. From an external or segmented network vantage point, verify that T3 and IIOP listeners are not reachable except from approved sources. Review firewall, load balancer, Kubernetes, and cloud security group rules for exposed WebLogic ports. If compensating controls are used, test that unauthorized hosts cannot complete T3 or IIOP/GIOP connections to WebLogic.

Typical attack path

1. Scan internet-facing or internal address ranges for Oracle WebLogic Server listeners, especially T3/IIOP-enabled ports.
2. Confirm WebLogic protocol exposure using T3 or IIOP/GIOP handshakes or service fingerprints.
3. Identify targets running affected WebLogic Server versions 12.2.1.4.0 or 14.1.1.0.0 without the relevant Oracle Critical Patch Update.
4. Send crafted unauthenticated T3 or IIOP traffic to trigger the information disclosure condition.
5. Collect exposed server-accessible data and analyze it for sensitive records, secrets, session material, configuration details, or information enabling follow-on attacks.

How to detect it

To determine whether exploitation may already have occurred, review WebLogic AdminServer and Managed Server logs, HTTP/access logs if protocol traffic is proxied, diagnostic logs, network flow logs, firewall logs, IDS/IPS alerts, and packet captures for unauthenticated T3 or IIOP/GIOP connections from untrusted sources. Focus on unusual inbound connections to WebLogic listen ports, especially 7001, 7002, or custom ports used for T3/IIOP; repeated protocol handshakes without normal application behavior; connections from scanners, hosting providers, or geographies not expected to access middleware protocols; and anomalous data transfer volume following protocol negotiation. Because this vulnerability is an information disclosure issue, exploitation may leave limited application-layer evidence and may not create files or processes. Correlate suspicious protocol activity with subsequent access to sensitive application functions, credential stores, configuration endpoints, or administrative interfaces. If suspicious access is found, preserve logs and packet captures, identify data potentially exposed to the WebLogic process, and consider credential rotation for secrets accessible from affected applications.

• Inbound T3 protocol traffic to WebLogic listen ports such as 7001 or 7002
• Inbound IIOP/GIOP protocol traffic to WebLogic listen ports such as 7001 or 7002
• Network payload beginning with "t3 "
• Network payload containing "GIOP"
• Unexpected external connections to TCP/7001
• Unexpected external connections to TCP/7002
• WebLogic Server version 12.2.1.4.0 without the applicable Oracle Critical Patch Update
• WebLogic Server version 14.1.1.0.0 without the applicable Oracle Critical Patch Update

What your security team should do

• Prioritize patching of any internet-facing or broadly reachable Oracle WebLogic Server instances running 12.2.1.4.0 or 14.1.1.0.0.
• Inventory all WebLogic deployments, including non-production, disaster-recovery, containerized, and embedded Fusion Middleware installations.
• Restrict T3 and IIOP network access to only trusted middleware clients and administrative networks; block access from the internet and general user subnets.
• Disable unused WebLogic protocols and services where supported by the application architecture.
• Review WebLogic and network telemetry for unauthenticated T3/IIOP access attempts, especially from unknown external IP addresses.
• Hunt for evidence of sensitive data access following suspicious protocol activity and rotate exposed secrets if disclosure is suspected.
• Add recurring checks to vulnerability management and configuration monitoring to ensure WebLogic CPU patch levels remain current.