Improper input validation in Oracle WebLogic Server - CVE-2023-7272
Published: January 21, 2025
Vulnerability identifier: #VU103149
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-7272
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to a crash the entire system.
The vulnerability exists due to improper input validation within the Centralized Thirdparty Jars (Eclipse Parsson) component in Oracle WebLogic Server. A remote non-authenticated attacker can exploit this vulnerability to a crash the entire system.
Affected software
Oracle WebLogic Server
Oracle Business Intelligence Enterprise Edition
IBM OpenPages with Watson
Operational Decision Manager
Oracle Business Intelligence Enterprise Edition
IBM OpenPages with Watson
Operational Decision Manager
How to mitigate CVE-2023-7272
Install updates from vendor's website.
IBM OpenPages with Watson - update to 9.0.0.5.3
Operational Decision Manager - addressed in versions 8.11.0.1 Interim fix 46, 8.11.1 Interim fix 44, 8.12.0.1 Interim fix 28, 9.0.0.1 Interim fix 11, 9.5.0.0 Interim fix 2
Operational Decision Manager - addressed in versions 8.11.0.1 Interim fix 46, 8.11.1 Interim fix 44, 8.12.0.1 Interim fix 28, 9.0.0.1 Interim fix 11, 9.5.0.0 Interim fix 2