PT-2007-4013 · Bea · Bea Weblogic Server

Published 2007-05-16 · Updated 2017-07-29 · CVE-2007-2696

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server versions 6.1 through SP7 BEA WebLogic Server versions 7.0 through SP6 BEA WebLogic Server versions 8.1 through SP5

Description The issue concerns the JMS Server in BEA WebLogic Server, where security access policies are enforced on the front end. This allows remote attackers to access protected queues by making direct requests to the JMS back-end server.

Recommendations For BEA WebLogic Server versions 6.1 through SP7, consider restricting direct access to the JMS back-end server to prevent exploitation. For BEA WebLogic Server versions 7.0 through SP6, restrict direct access to the JMS back-end server to minimize the risk of unauthorized queue access. For BEA WebLogic Server versions 8.1 through SP5, limit direct requests to the JMS back-end server as a temporary mitigation measure until a fix is available.

Fix

Related Identifiers

CVE-2007-2696

Affected Products

Bea Weblogic Server

References · 8

• http://secunia.com/advisories/25284 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2696 · Security Note
• http://dev2dev.bea.com/pub/advisory/228 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34284 · Note
• http://vupen.com/english/advisories/2007/1815 · Note
• http://securitytracker.com/id?1018057 · Note
• http://osvdb.org/36073 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2696 · Note