PT-2007-4022 · Bea · Weblogic Integration+1

Published 2007-05-16 · Updated 2017-07-29 · CVE-2007-2705

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic Integration versions 9.2 before SP1 BEA WebLogic Workshop versions 8.1 SP2 through 8.1 SP6

Description A directory traversal issue exists in the Test View Console of BEA WebLogic Integration and WebLogic Workshop, allowing remote attackers to list a parent directory of the WebLogic Workshop Directory (wlwdir) when deployed in an exploded format.

Recommendations For BEA WebLogic Integration version 9.2 before SP1, update to SP1 or later to resolve the issue. For BEA WebLogic Workshop versions 8.1 SP2 through 8.1 SP6, consider restricting access to the Test View Console until a patch is available.

Fix

Related Identifiers

CVE-2007-2705

Affected Products

Weblogic Integration

Bea Weblogic Workshop

References · 6

• http://dev2dev.bea.com/pub/advisory/239 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2705 · Security Note
• http://securitytracker.com/id?1018059 · Note
• http://vupen.com/english/advisories/2007/1815 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34281 · Note
• http://osvdb.org/36063 · Note