PT-2007-4016 · Bea · Bea Weblogic Server+1

Publicado 2007-05-16 · Atualizado 2019-05-28 · CVE-2007-2699

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server versions 9.0 through 9.1 BEA WebLogic Express versions 9.0 through 9.1

Description The issue is related to the Administration Console in the affected software, which fails to properly enforce certain Domain Security Policies. This allows remote administrative users in the Deployer role to upload arbitrary files.

Recommendations For BEA WebLogic Server versions 9.0 through 9.1, restrict access to the Administration Console to minimize the risk of exploitation. For BEA WebLogic Express versions 9.0 through 9.1, consider disabling file upload functionality for the Deployer role until a fix is available.

Correção

Identificadores relacionados

CVE-2007-2699

Produtos afetados

Bea Weblogic Express

Bea Weblogic Server

Referências · 9

• http://secunia.com/advisories/25284 · Aviso do Fabricante
• http://packetstormsecurity.com/files/153072/Oracle-Application-Testing-Suite-WebLogic-Server-Administration-Console-War-Deployment.html · Nota
• http://osvdb.org/36069 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34289 · Nota
• http://dev2dev.bea.com/pub/advisory/231 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-2699 · Nota de Segurança
• http://vupen.com/english/advisories/2007/1815 · Nota
• http://securitytracker.com/id?1018057 · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2699 · Nota