PT-2006-3415 · Bea · Bea Weblogic Server

Published 2006-05-19 · Updated 2017-07-20 · CVE-2006-2467

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server versions 8.1 up to SP4 BEA WebLogic Server versions 7.0 up to SP6 BEA WebLogic Server versions 6.1 up to SP7

Description The issue allows remote authenticated administrators to determine the internal IP address of the WebLogic server through the WebLogic Server Administration Console.

Recommendations For BEA WebLogic Server versions 8.1 up to SP4, consider restricting access to the WebLogic Server Administration Console to minimize the risk of exploitation. For BEA WebLogic Server versions 7.0 up to SP6, restrict access to the WebLogic Server Administration Console until a fix is available. For BEA WebLogic Server versions 6.1 up to SP7, limit access to the WebLogic Server Administration Console as a temporary mitigation measure.

Fix

Related Identifiers

CVE-2006-2467

Affected Products

Bea Weblogic Server

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2006-2467 · Security Note
• http://secunia.com/advisories/20130 · Vendor Advisory
• http://dev2dev.bea.com/pub/advisory/191 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26462 · Note
• http://securitytracker.com/id?1016099 · Note
• http://securitytracker.com/id?1016097 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2467 · Note
• http://vupen.com/english/advisories/2006/1828 · Note