PT-2007-1897 · Bea · Bea Weblogic Portal+1

Published 2007-01-23 · Updated 2018-10-30 · CVE-2007-0426

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BEA WebLogic Portal version 9.2

Description The issue arises when BEA WebLogic Portal 9.2 is running in a WebLogic Server clustered environment and utilizing WebLogic Portal entitlements. If entitlement policy changes are made on a managed server while the Administrative Server is unavailable, these changes are not properly propagated, potentially allowing attackers to bypass intended restrictions.

Recommendations For BEA WebLogic Portal version 9.2, ensure that entitlement policy changes are made when the Administrative Server is available to properly propagate these changes across the clustered environment. As a temporary workaround, consider restricting changes to entitlement policies until the Administrative Server is available.

Fix

Related Identifiers

CVE-2007-0426

Affected Products

Bea Weblogic Portal

Oracle Weblogic Server

References · 8

• http://dev2dev.bea.com/pub/advisory/223 · Vendor Advisory
• http://secunia.com/advisories/23750 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-0426 · Security Note
• http://osvdb.org/38516 · Note
• http://vupen.com/english/advisories/2007/0213 · Note
• http://osvdb.org/32854 · Note
• http://securityfocus.com/bid/22082 · Note
• http://securitytracker.com/id?1017521 · Note