U.S. Dept Of Defense · Report #804548

[█████████] Administrative access to Oracle WebLogic Server using default credentials

Validstatus

criticalseverity

65upvotes

25 Jun 2020disclosed

Summary

Hello. I discovered an Oracle WebLogic Server and because of weak credentials managed to login as administrator, which led to complete server takeover.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original