CVE-2007-2697

The embedded LDAP server in BEA WebLogic Express and WebLogic Server 7.0 through SP6, 8.1 through SP5, 9.0, and 9.1, when in certain configurations, does not limit or audit failed authentication attempts, which allows remote attackers to more easily conduct brute-force attacks against the administrator password, or flood the server with login attempts and cause a denial of service.

Link	Resource
http://dev2dev.bea.com/pub/advisory/229	Patch Vendor Advisory
http://securitytracker.com/id?1018057
http://secunia.com/advisories/25284
http://osvdb.org/36072
http://www.vupen.com/english/advisories/2007/1815
https://exchange.xforce.ibmcloud.com/vulnerabilities/34291

Configuration 1

cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:8.1:sp5:express:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:7.0:sp7:express:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:9.0:ga:*:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:9.0:*:express:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:9.1:*:express:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:9.1:ga:*:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:7.0:sp6:express:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*

---

Published : 2007-05-16 01:19

Updated : 2017-07-29 01:31

---

NVD link : CVE-2007-2697

Mitre link : CVE-2007-2697

No products.

NVD-CWE-Other