CVE-2007-0412: Medium severity Bea WebLogic Server vulnerability
Published Jan 23, 2007
·Updated
BEA WebLogic Server 6.1 through 6.1 SP7, 7.0 through 7.0 SP7, and 8.1 through 8.1 SP5 allows remote attackers to read arbitrary files inside the class-path property via .ear or exploded .ear files that use the manifest class-path property to point to utility jar files.
Affected Software
22 affected components
Bea WebLogic Server=6.1
Bea WebLogic Server=6.1-sp1
Bea WebLogic Server=6.1-sp2
Bea WebLogic Server=6.1-sp3
Bea WebLogic Server=6.1-sp4
Bea WebLogic Server=6.1-sp5
Bea WebLogic Server=6.1-sp6
Bea WebLogic Server=6.1-sp7
Bea WebLogic Server=7.0
Bea WebLogic Server=7.0-sp1
Bea WebLogic Server=7.0-sp2
Bea WebLogic Server=7.0-sp3
Bea WebLogic Server=7.0-sp4
Bea WebLogic Server=7.0-sp5
Bea WebLogic Server=7.0-sp6
Bea WebLogic Server=7.0-sp7
Bea WebLogic Server=8.1
Bea WebLogic Server=8.1-sp1
Bea WebLogic Server=8.1-sp2
Bea WebLogic Server=8.1-sp3
Bea WebLogic Server=8.1-sp4
Bea WebLogic Server=8.1-sp5
Remediation
Patch Available
Event History
Jan 23, 2007
CVE Published
12:28 AM
CVE Published
via MITRE·05:00 AM
Data Sourced
via MITRE·05:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2007-0412?
CVE-2007-0412 is classified as a moderate severity vulnerability.
2
How do I fix CVE-2007-0412?
Fixing CVE-2007-0412 involves upgrading to a patched version of BEA WebLogic Server.
3
What are the affected versions of BEA WebLogic Server for CVE-2007-0412?
CVE-2007-0412 affects BEA WebLogic Server versions 6.1 through 6.1 SP7, 7.0 through 7.0 SP7, and 8.1 through 8.1 SP5.
4
Can CVE-2007-0412 lead to unauthorized access to files?
Yes, CVE-2007-0412 allows remote attackers to read arbitrary files within the class-path property.
5
What type of attack does CVE-2007-0412 facilitate?
CVE-2007-0412 facilitates attacks through malicious .ear files that exploit the manifest class-path property.