PT-2007-4012 · Bea · Oracle Weblogic Server+1

Published 2007-05-16 · Updated 2017-07-29 · CVE-2007-2695

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BEA WebLogic Express and WebLogic Server versions 6.1 through SP7 BEA WebLogic Express and WebLogic Server versions 7.0 through SP7 BEA WebLogic Express and WebLogic Server versions 8.1 through SP5 BEA WebLogic Express and WebLogic Server version 9.0 BEA WebLogic Express and WebLogic Server version 9.1

Description The issue allows remote attackers to access administrative data or functionality when SecureProxy is enabled. This is due to the HttpClusterServlet and HttpProxyServlet processing external requests on behalf of a system identity.

Recommendations For BEA WebLogic Express and WebLogic Server versions 6.1 through SP7, consider disabling SecureProxy to prevent external requests from being processed on behalf of a system identity. For BEA WebLogic Express and WebLogic Server versions 7.0 through SP7, consider disabling SecureProxy to prevent external requests from being processed on behalf of a system identity. For BEA WebLogic Express and WebLogic Server versions 8.1 through SP5, consider disabling SecureProxy to prevent external requests from being processed on behalf of a system identity. For BEA WebLogic Express and WebLogic Server version 9.0, consider disabling SecureProxy to prevent external requests from being processed on behalf of a system identity. For BEA WebLogic Express and WebLogic Server version 9.1, consider disabling SecureProxy to prevent external requests from being processed on behalf of a system identity.

Fix

Related Identifiers

CVE-2007-2695

Affected Products

Weblogic Express

Oracle Weblogic Server

References · 11

• http://secunia.com/advisories/25284 · Vendor Advisory
• http://dev2dev.bea.com/pub/advisory/274 · Vendor Advisory
• http://securitytracker.com/id?1018057 · Patch
• http://dev2dev.bea.com/pub/advisory/227 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2695 · Security Note
• http://vupen.com/english/advisories/2007/1815 · Note
• http://secunia.com/advisories/29041 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34282 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2695 · Note
• http://vupen.com/english/advisories/2008/0612/references · Note
• http://osvdb.org/36074 · Note