PT-2007-1887 · Bea · Bea Weblogic Server

Publicado 2007-01-23 · Atualizado 2011-03-08 · CVE-2007-0416

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server versions 9.0 through 9.1

Description The issue concerns the WSEE runtime in BEA WebLogic Server, where it fails to verify credentials when decrypting client messages. This allows remote attackers to bypass application security.

Recommendations For BEA WebLogic Server versions 9.0 through 9.1, update the WSEE runtime to a version that properly verifies credentials during the decryption of client messages.

Correção

Identificadores relacionados

CVE-2007-0416

Produtos afetados

Bea Weblogic Server

Referências · 8

• http://osvdb.org/38510 · Nota
• http://dev2dev.bea.com/pub/advisory/210 · Aviso do Fabricante
• http://secunia.com/advisories/23750 · Nota
• http://vupen.com/english/advisories/2007/0213 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-0416 · Nota de Segurança
• http://securityfocus.com/bid/22082 · Nota
• http://securitytracker.com/id?1017525 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0416 · Nota