Exploit for Improper Access Control in Oracle Weblogic Server

CVE-2024-20931

githubexploit · 2024-02-02

Description

Analysis of JNDI injection exploit for CVE-2024-20931

Affected Oracle Weblogic Server versions

Oracle Weblogic Server= 12.2.1.4.0, 14.1.1.0.0

All known vulnerabilities by product

Oracle Weblogic Server

CVSS 7.5 for CVE-2024-20931

7.5

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:NONE

Availability:NONE

Working code

64%confidence this exploit runs

Based on 2 file(s) in the source

EPSS Score

59.7%higher than 99.0% of all CVEs

Updated 2026-06-16

Exploit Details

Modified:2025-08-28 00:38

Last Seen:2025-08-31 21:52

Reporter:GlassyAmadeus

Written in:Java

Last commit:2024-02-02

Other exploits for CVE-2024-20931

Exploit for Improper Access Control in Oracle Weblogic_Server

2024-02-06 dinosnGITHUB

Exploit Code

README5 lines

## https://sploitus.com/exploit?id=A254D61C-8072-5142-80F7-C2A84C54ADA9
# CVE-2024-20931  
The PoC for CVE-2024-20931  
## Vulnerability Analysis  
[A New Attack Surface for JNDI Injection – Analysis of CVE-2024-20931](https://glassyamadeus.github.io/2024/01/31/CVE_2024_20931/)

Exploit Code

Share

Share on social media: