CVE Vulnerability

CVE-2007-2699

The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce certain Domain Security Policies, which allows remote administrative users in the Deployer role to upload arbitrary files.

7.1 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 10

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

Scope

References
Link Resource
http://dev2dev.bea.com/pub/advisory/231 Patch Vendor Advisory
http://securitytracker.com/id?1018057 Patch
http://secunia.com/advisories/25284 Vendor Advisory
http://osvdb.org/36069
http://www.vupen.com/english/advisories/2007/1815
https://exchange.xforce.ibmcloud.com/vulnerabilities/34289
http://packetstormsecurity.com/files/153072/Oracle-Application-Testing-Suite-WebLogic-Server-Administration-Console-War-Deployment.html
Configurations

Configuration 1

cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*
cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*
cpe:2.3:a:bea:weblogic_server:9.0:*:express:*:*:*:*:*
cpe:2.3:a:bea:weblogic_server:9.1:*:express:*:*:*:*:*
Information

Published : 2007-05-16 01:19

Updated : 2019-05-28 05:29

NVD link : CVE-2007-2699

Mitre link : CVE-2007-2699

Products Affected
No products.
CWE
NVD-CWE-Other