WebLogic on RSA AM SecurID

[FabienBeche]

Dears,

Can you please let me know what for is used WebLogic on RSA AM and RSA AM Web-Tier?

Can you please also let me know what is the risk if ever vulnerability CVE-2023-21839 is exploited?

What kind of data can be retrieved and/or corrupted?

Thanks

[EricaChalfin]

@FabienBeche, 

We use Oracle WebLogic Server to create our Authentication Manager web pages.

CVE-2023-21839 is addressed in Authentication Manager 8.7 patch 3.

[FabienBeche]

@EricaChalfin thanks for your reply.

I know that it is fixed in Patch 3... that's why I am waiting for it to ber published back.

Does it mean that it can access almost all RSA AM data?

[EricaChalfin · Accepted solution]

@FabienBeche.

Some additional information:

CVE-2023-21839 is listed in the Oracle Critical Patch Update Advisory - January 2023, the remediation of which will be included in Authentication Manager 8.7 patch 3.The CVE has a score of 7.5. Our review finds that is not "proven to be actually exploitable" in Authentication Manger.

The Authentication Manager iteration of the Oracle WebLogic server is not your typical WebLogic server. There is no WebLogic console, all access is through the Authentication Manager Admin API. The vulnerability is caused by the ability to set the remote JNDI name and bind it to an object on the WebLogic server. This can be done using the weblogic.deployment.jms.ForeignOpaqueReference class.

There are zero mentions of the  'weblogic.deployment.jms.ForeignOpaqueReference' class anywhere in our internal support tools. Therefore, Support echoes Engineering's findings, that CVE-2023-21839 is not known to be exploitable in Authentication Manager 8.7 and the risk appears to be low.

We recommend waiting for Authentication Manager 8.7 patch 3 and updating to it. As I am sure you are, we anxiously await it being released.

[FabienBeche]

Thanks for the additional information, they will be useful.