PT-2007-4012 · Bea · Oracle Weblogic Server+1

Publicado 2007-05-16 · Atualizado 2017-07-29 · CVE-2007-2695

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BEA WebLogic Express and WebLogic Server versions 6.1 through SP7 BEA WebLogic Express and WebLogic Server versions 7.0 through SP7 BEA WebLogic Express and WebLogic Server versions 8.1 through SP5 BEA WebLogic Express and WebLogic Server version 9.0 BEA WebLogic Express and WebLogic Server version 9.1

Description The issue allows remote attackers to access administrative data or functionality when SecureProxy is enabled. This is due to the HttpClusterServlet and HttpProxyServlet processing external requests on behalf of a system identity.

Recommendations For BEA WebLogic Express and WebLogic Server versions 6.1 through SP7, consider disabling SecureProxy to prevent external requests from being processed on behalf of a system identity. For BEA WebLogic Express and WebLogic Server versions 7.0 through SP7, consider disabling SecureProxy to prevent external requests from being processed on behalf of a system identity. For BEA WebLogic Express and WebLogic Server versions 8.1 through SP5, consider disabling SecureProxy to prevent external requests from being processed on behalf of a system identity. For BEA WebLogic Express and WebLogic Server version 9.0, consider disabling SecureProxy to prevent external requests from being processed on behalf of a system identity. For BEA WebLogic Express and WebLogic Server version 9.1, consider disabling SecureProxy to prevent external requests from being processed on behalf of a system identity.

Correção

Identificadores relacionados

CVE-2007-2695

Produtos afetados

Weblogic Express

Oracle Weblogic Server

Referências · 11

• http://secunia.com/advisories/25284 · Aviso do Fabricante
• http://dev2dev.bea.com/pub/advisory/274 · Aviso do Fabricante
• http://vupen.com/english/advisories/2007/1815 · Nota
• http://securitytracker.com/id?1018057 · Correção
• http://secunia.com/advisories/29041 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34282 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2695 · Nota
• http://dev2dev.bea.com/pub/advisory/227 · Aviso do Fabricante
• http://vupen.com/english/advisories/2008/0612/references · Nota
• http://osvdb.org/36074 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-2695 · Nota de Segurança