CVE-2007-2695
First published: Wed May 16 2007(Updated: )
The HttpClusterServlet and HttpProxyServlet in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0, and 9.1, when SecureProxy is enabled, may process "external requests on behalf of a system identity," which allows remote attackers to access administrative data or functionality.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle WebLogic Server | =8.1 | |
| Oracle WebLogic Server | =7.0-sp2 | |
| Oracle WebLogic Server | =6.1-sp4 | |
| Oracle WebLogic Server | =7.0-sp7 | |
| Oracle WebLogic Server | =6.1 | |
| Oracle WebLogic Server | =8.1 | |
| Oracle WebLogic Server | =6.1-sp5 | |
| Oracle WebLogic Server | =9.0 | |
| Oracle WebLogic Server | =6.1-sp6 | |
| Oracle WebLogic Server | =7.0-sp4 | |
| Oracle WebLogic Server | =6.1-sp1 | |
| Oracle WebLogic Server | =7.0 | |
| Oracle WebLogic Server | =6.1-sp4 | |
| Oracle WebLogic Server | =6.1-sp7 | |
| Oracle WebLogic Server | =6.1-sp3 | |
| Oracle WebLogic Server | =8.1-sp5 | |
| Oracle WebLogic Server | =7.0-sp6 | |
| Oracle WebLogic Server | =7.0-sp3 | |
| Oracle WebLogic Server | =6.1-sp6 | |
| Oracle WebLogic Server | =8.1-sp5 | |
| Oracle WebLogic Server | =8.1-sp3 | |
| Oracle WebLogic Server | =7.0-sp2 | |
| Oracle WebLogic Server | =9.1-ga | |
| Oracle WebLogic Server | =7.0-sp7 | |
| Oracle WebLogic Server | =7.0-sp3 | |
| Oracle WebLogic Server | =8.1-sp4 | |
| Oracle WebLogic Server | =7.0-sp5 | |
| Oracle WebLogic Server | =7.0-sp5 | |
| Oracle WebLogic Server | =9.1 | |
| Oracle WebLogic Server | =6.1-sp1 | |
| Oracle WebLogic Server | =8.1-sp1 | |
| Oracle WebLogic Server | =9.0 | |
| Oracle WebLogic Server | =8.1-sp3 | |
| Oracle WebLogic Server | =8.1-sp2 | |
| Oracle WebLogic Server | =6.1 | |
| Oracle WebLogic Server | =6.1-sp2 | |
| Oracle WebLogic Server | =7.0-sp1 | |
| Oracle WebLogic Server | =6.1-sp5 | |
| Oracle WebLogic Server | =8.1-sp1 | |
| Oracle WebLogic Server | =6.1-sp3 | |
| Oracle WebLogic Server | =7.0-sp1 | |
| Oracle WebLogic Server | =8.1-sp4 | |
| Oracle WebLogic Server | =6.1-sp2 | |
| Oracle WebLogic Server | =8.1-sp2 | |
| Oracle WebLogic Server | =6.1-sp7 | |
| Oracle WebLogic Server | =7.0 | |
| Oracle WebLogic Server | =7.0-sp6 | |
| Oracle WebLogic Server | =7.0-sp4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://dev2dev.bea.com/pub/advisory/227
- http://securitytracker.com/id?1018057
- http://secunia.com/advisories/25284
- http://dev2dev.bea.com/pub/advisory/274
- http://secunia.com/advisories/29041
- http://osvdb.org/36074
- http://www.vupen.com/english/advisories/2007/1815
- http://www.vupen.com/english/advisories/2008/0612/references
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34282
Frequently Asked Questions
What is the severity of CVE-2007-2695?
CVE-2007-2695 is considered to have a critical severity due to the potential for unauthorized access to administrative functions.
How do I fix CVE-2007-2695?
To fix CVE-2007-2695, update your BEA WebLogic Server to a version that has patched this vulnerability.
What versions of WebLogic are affected by CVE-2007-2695?
CVE-2007-2695 affects BEA WebLogic Server versions 6.1 through 9.1 with certain service packs.
Can CVE-2007-2695 be exploited remotely?
Yes, CVE-2007-2695 can be exploited remotely by attackers if the vulnerable WebLogic Server instance is exposed.
What type of attacks could be executed via CVE-2007-2695?
Exploiting CVE-2007-2695 could allow attackers to access sensitive administrative functionalities, leading to potential data breaches.
- agent/type
- agent/event
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/description
- agent/severity
- agent/references
- agent/author
- agent/weakness
- vendor/bea
- canonical/oracle weblogic server
- version/oracle weblogic server/8.1
- version/oracle weblogic server/7.0-sp2
- version/oracle weblogic server/6.1-sp4
- version/oracle weblogic server/7.0-sp7
- version/oracle weblogic server/6.1
- version/oracle weblogic server/6.1-sp5
- version/oracle weblogic server/9.0
- version/oracle weblogic server/6.1-sp6
- version/oracle weblogic server/7.0-sp4
- version/oracle weblogic server/6.1-sp1
- version/oracle weblogic server/7.0
- version/oracle weblogic server/6.1-sp7
- version/oracle weblogic server/6.1-sp3
- version/oracle weblogic server/8.1-sp5
- version/oracle weblogic server/7.0-sp6
- version/oracle weblogic server/7.0-sp3
- version/oracle weblogic server/8.1-sp3
- version/oracle weblogic server/9.1-ga
- version/oracle weblogic server/8.1-sp4
- version/oracle weblogic server/7.0-sp5
- version/oracle weblogic server/9.1
- version/oracle weblogic server/8.1-sp1
- version/oracle weblogic server/8.1-sp2
- version/oracle weblogic server/6.1-sp2
- version/oracle weblogic server/7.0-sp1