SB2025071676 - Multiple vulnerabilities in Oracle WebLogic Server
Published: July 16, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 secuirty vulnerabilities.
1) Improper input validation (CVE-ID: CVE-2025-50072)
The vulnerability allows a local non-authenticated attacker to manipulate data.
The vulnerability exists due to improper input validation within the Core component in Oracle WebLogic Server. A local non-authenticated attacker can exploit this vulnerability to manipulate data.
2) Improper input validation (CVE-ID: CVE-2025-50064)
The vulnerability allows a remote privileged user to read and manipulate data.
The vulnerability exists due to improper input validation within the Core component in Oracle WebLogic Server. A remote privileged user can exploit this vulnerability to read and manipulate data.
3) Improper input validation (CVE-ID: CVE-2025-50073)
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The vulnerability exists due to improper input validation within the Web Container component in Oracle WebLogic Server. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.
4) Improper input validation (CVE-ID: CVE-2025-30753)
The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation within the Core component in Oracle WebLogic Server. A remote authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.
5) Improper input validation (CVE-ID: CVE-2025-30762)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The vulnerability exists due to improper input validation within the Core component in Oracle WebLogic Server. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.
6) Resource management error (CVE-ID: CVE-2024-57699)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper management of internal resources within the application when handling a specially crafted JSON input. A remote attacker can pass a large number of ’{’ characters to the application and perform a denial of service (DoS) attack.
Note, the vulnerability exists due to incomplete fix for #VU75044 (CVE-2023-1370).
7) Path traversal (CVE-ID: CVE-2024-38819)
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences in applications that serve static resources through the functional web frameworks WebMvc.fn or WebFlux.fn. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.
8) Improper access control (CVE-ID: CVE-2025-48734)
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions to enum properties. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty().
Remediation
Install update from vendor's website.