PT-2007-1883 · Bea · Bea Weblogic Server

Published 2007-01-23 · Updated 2018-10-17 · CVE-2007-0412

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server versions 6.1 through 6.1 SP7 BEA WebLogic Server versions 7.0 through 7.0 SP7 BEA WebLogic Server versions 8.1 through 8.1 SP5

Description The issue allows remote attackers to read arbitrary files inside the class-path property via .ear or exploded .ear files that use the manifest class-path property to point to utility jar files.

Recommendations For BEA WebLogic Server versions 6.1 through 6.1 SP7, consider restricting access to .ear and exploded .ear files to minimize the risk of exploitation. For BEA WebLogic Server versions 7.0 through 7.0 SP7, avoid using the manifest class-path property to point to utility jar files until the issue is resolved. For BEA WebLogic Server versions 8.1 through 8.1 SP5, restrict the class-path property to only include necessary files and directories to reduce the attack surface.

Fix

Related Identifiers

CVE-2007-0412

Affected Products

Bea Weblogic Server

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2007-0412 · Security Note
• http://dev2dev.bea.com/pub/advisory/206 · Vendor Advisory
• http://secunia.com/advisories/23750 · Note
• http://vupen.com/english/advisories/2007/0213 · Note
• http://osvdb.org/38505 · Note
• http://securityfocus.com/bid/22082 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0412 · Note
• http://securitytracker.com/id?1017525 · Note