PT-2006-3415 · Bea · Bea Weblogic Server

Publicado 2006-05-19 · Atualizado 2017-07-20 · CVE-2006-2467

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server versions 8.1 up to SP4 BEA WebLogic Server versions 7.0 up to SP6 BEA WebLogic Server versions 6.1 up to SP7

Description The issue allows remote authenticated administrators to determine the internal IP address of the WebLogic server through the WebLogic Server Administration Console.

Recommendations For BEA WebLogic Server versions 8.1 up to SP4, consider restricting access to the WebLogic Server Administration Console to minimize the risk of exploitation. For BEA WebLogic Server versions 7.0 up to SP6, restrict access to the WebLogic Server Administration Console until a fix is available. For BEA WebLogic Server versions 6.1 up to SP7, limit access to the WebLogic Server Administration Console as a temporary mitigation measure.

Correção

Identificadores relacionados

CVE-2006-2467

Produtos afetados

Bea Weblogic Server

Referências · 8

• https://exchange.xforce.ibmcloud.com/vulnerabilities/26462 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2467 · Nota de Segurança
• http://securitytracker.com/id?1016099 · Nota
• http://securitytracker.com/id?1016097 · Nota
• http://secunia.com/advisories/20130 · Aviso do Fabricante
• http://dev2dev.bea.com/pub/advisory/191 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2467 · Nota
• http://vupen.com/english/advisories/2006/1828 · Nota