CVE-2022-21371: Oracle WebLogic path traversal that leaks internal files
The short version: CVE-2022-21371 is an unauthenticated path-traversal (local file inclusion) flaw in the Web Container of Oracle WebLogic Server. A crafted request lets an attacker read internal files — deployment descriptors like web.xml, application code, and configuration. It's not code execution, but the details it leaks (paths, credentials, config) can set up a bigger attack. Steady hands: patch in your normal cadence and don't leave WebLogic wide open.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — by default; higher if the leaked files contain secrets (see below) |
| CVSS v3.1 (NVD) | 7.5 — High · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| EPSS | 92.3% · 99.8th percentile (2026-07-17) |
| In CISA KEV? | No — not listed as of writing |
| Known exploited? | Not confirmed in the wild; proof-of-concept tooling is public |
| Vulnerability type | CWE-22 path traversal / local file inclusion → unauthenticated read of internal files |
| Requires authenticated session? | No — pre-authentication |
| Affected | Oracle WebLogic Server 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 (Web Container) |
| Fixed in | Oracle Critical Patch Update, January 2022 |
What you need to know
WebLogic's Web Container serves web applications, and CVE-2022-21371 is a path traversal in how it handles certain dash-containing URLs. An unauthenticated attacker sends a crafted request and reads files they shouldn't — including deployment descriptors (web.xml, weblogic.xml), the MANIFEST.MF, and other internal application files.
This is a read, not a takeover — but it's a useful read:
- It's unauthenticated and easy to automate. No login; the high EPSS reflects how mechanical the request is.
- The leaked files are reconnaissance gold. Deployment descriptors and config can reveal internal paths, framework details, and sometimes credentials or secrets — the raw material for a follow-on attack.
- It's confidentiality-only. The attacker can read, not modify or delete (I:N/A:N). There's no confirmed in-the-wild exploitation and it isn't in CISA's KEV catalog, though PoC tooling is public.
How serious we see it
High — and here the practical severity runs below the 7.5 High base score, honestly stated.
CVSS scores confidentiality-only information disclosure at 7.5, but on its own this doesn't take over anything — it leaks files. We rate it Moderate by default: it's real, unauthenticated, and worth fixing, but it's not the drop-everything emergency the RCE bugs on this platform are. The honest upside risk is what leaks — if those descriptors or config files contain credentials or secrets, this becomes the first link in a chain and the effective severity climbs. It's also not in KEV and has no confirmed in-the-wild use.
The bounded, reassuring part: it affects specific WebLogic versions, the January 2022 fix is published, exposure is quick to confirm, and it's fully in your hands to close.
Recommendations
Straight from Oracle's January 2022 CPU:
- Patch. Apply the January 2022 Critical Patch Update to affected WebLogic 12.1.3.0.0 / 12.2.1.3.0 / 12.2.1.4.0 / 14.1.1.0.0.
- Reduce exposure. Keep WebLogic's web interfaces off the open internet where you can; restrict to trusted networks.
- Assume the descriptors leaked and act on it. If you were exposed and unpatched, treat any credentials or secrets stored in the reachable config as potentially disclosed — and rotate them.
- Hunt. Review logs for crafted requests reading
WEB-INF/META-INFfiles. - Confirm your exposure first. Verify whether you run an affected WebLogic version with the web container reachable.
How BreachRisk sees it
BreachRisk works from the outside in. From little more than your domain it discovers internet-facing WebLogic interfaces, fingerprints the version, and flags exposure tied to this flaw. Where verification is enabled, it goes a safe step beyond a scanner: it sends benign requests to the affected paths and checks whether restricted files come back — confirming the exposure holds, as a benign read check rather than a data grab.
That's the difference between "this looks like a vulnerable WebLogic build" and "we confirmed it leaks internal files" — so you can prioritize the patch and the credential rotation with confidence.