PT-2007-1883 · Bea · Bea Weblogic Server

Publicado 2007-01-23 · Atualizado 2018-10-17 · CVE-2007-0412

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server versions 6.1 through 6.1 SP7 BEA WebLogic Server versions 7.0 through 7.0 SP7 BEA WebLogic Server versions 8.1 through 8.1 SP5

Description The issue allows remote attackers to read arbitrary files inside the class-path property via .ear or exploded .ear files that use the manifest class-path property to point to utility jar files.

Recommendations For BEA WebLogic Server versions 6.1 through 6.1 SP7, consider restricting access to .ear and exploded .ear files to minimize the risk of exploitation. For BEA WebLogic Server versions 7.0 through 7.0 SP7, avoid using the manifest class-path property to point to utility jar files until the issue is resolved. For BEA WebLogic Server versions 8.1 through 8.1 SP5, restrict the class-path property to only include necessary files and directories to reduce the attack surface.

Correção

Identificadores relacionados

CVE-2007-0412

Produtos afetados

Bea Weblogic Server

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2007-0412 · Nota de Segurança
• http://secunia.com/advisories/23750 · Nota
• http://vupen.com/english/advisories/2007/0213 · Nota
• http://osvdb.org/38505 · Nota
• http://securityfocus.com/bid/22082 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0412 · Nota
• http://securitytracker.com/id?1017525 · Nota
• http://dev2dev.bea.com/pub/advisory/206 · Aviso do Fabricante