PT-2007-1887 · Bea · Bea Weblogic Server

Published 2007-01-23 · Updated 2011-03-08 · CVE-2007-0416

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server versions 9.0 through 9.1

Description The issue concerns the WSEE runtime in BEA WebLogic Server, where it fails to verify credentials when decrypting client messages. This allows remote attackers to bypass application security.

Recommendations For BEA WebLogic Server versions 9.0 through 9.1, update the WSEE runtime to a version that properly verifies credentials during the decryption of client messages.

Fix

Related Identifiers

CVE-2007-0416

Affected Products

Bea Weblogic Server

References · 8

• http://dev2dev.bea.com/pub/advisory/210 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-0416 · Security Note
• http://osvdb.org/38510 · Note
• http://secunia.com/advisories/23750 · Note
• http://vupen.com/english/advisories/2007/0213 · Note
• http://securityfocus.com/bid/22082 · Note
• http://securitytracker.com/id?1017525 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0416 · Note