PT-2007-4016 · Bea · Bea Weblogic Server+1

Published 2007-05-16 · Updated 2019-05-28 · CVE-2007-2699

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server versions 9.0 through 9.1 BEA WebLogic Express versions 9.0 through 9.1

Description The issue is related to the Administration Console in the affected software, which fails to properly enforce certain Domain Security Policies. This allows remote administrative users in the Deployer role to upload arbitrary files.

Recommendations For BEA WebLogic Server versions 9.0 through 9.1, restrict access to the Administration Console to minimize the risk of exploitation. For BEA WebLogic Express versions 9.0 through 9.1, consider disabling file upload functionality for the Deployer role until a fix is available.

Fix

Related Identifiers

CVE-2007-2699

Affected Products

Bea Weblogic Express

Bea Weblogic Server

References · 9

• http://secunia.com/advisories/25284 · Vendor Advisory
• http://dev2dev.bea.com/pub/advisory/231 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2699 · Security Note
• http://securitytracker.com/id?1018057 · Patch
• http://packetstormsecurity.com/files/153072/Oracle-Application-Testing-Suite-WebLogic-Server-Administration-Console-War-Deployment.html · Note
• http://osvdb.org/36069 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34289 · Note
• http://vupen.com/english/advisories/2007/1815 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2699 · Note