CVE-2007-2697
First published: Wed May 16 2007(Updated: )
The embedded LDAP server in BEA WebLogic Express and WebLogic Server 7.0 through SP6, 8.1 through SP5, 9.0, and 9.1, when in certain configurations, does not limit or audit failed authentication attempts, which allows remote attackers to more easily conduct brute-force attacks against the administrator password, or flood the server with login attempts and cause a denial of service.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle WebLogic Server | =7.0 | |
| Oracle WebLogic Server | =7.0 | |
| Oracle WebLogic Server | =7.0-sp1 | |
| Oracle WebLogic Server | =7.0-sp1 | |
| Oracle WebLogic Server | =7.0-sp2 | |
| Oracle WebLogic Server | =7.0-sp2 | |
| Oracle WebLogic Server | =7.0-sp3 | |
| Oracle WebLogic Server | =7.0-sp3 | |
| Oracle WebLogic Server | =7.0-sp4 | |
| Oracle WebLogic Server | =7.0-sp4 | |
| Oracle WebLogic Server | =7.0-sp5 | |
| Oracle WebLogic Server | =7.0-sp5 | |
| Oracle WebLogic Server | =7.0-sp6 | |
| Oracle WebLogic Server | =7.0-sp6 | |
| Oracle WebLogic Server | =7.0-sp7 | |
| Oracle WebLogic Server | =8.1 | |
| Oracle WebLogic Server | =8.1 | |
| Oracle WebLogic Server | =8.1-sp1 | |
| Oracle WebLogic Server | =8.1-sp1 | |
| Oracle WebLogic Server | =8.1-sp2 | |
| Oracle WebLogic Server | =8.1-sp2 | |
| Oracle WebLogic Server | =8.1-sp3 | |
| Oracle WebLogic Server | =8.1-sp3 | |
| Oracle WebLogic Server | =8.1-sp4 | |
| Oracle WebLogic Server | =8.1-sp4 | |
| Oracle WebLogic Server | =8.1-sp5 | |
| Oracle WebLogic Server | =8.1-sp5 | |
| Oracle WebLogic Server | =9.0 | |
| Oracle WebLogic Server | =9.0 | |
| Oracle WebLogic Server | =9.0-ga | |
| Oracle WebLogic Server | =9.1 | |
| Oracle WebLogic Server | =9.1 | |
| Oracle WebLogic Server | =9.1-ga |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2007-2697?
CVE-2007-2697 has a medium severity rating due to the potential for brute-force attacks against the embedded LDAP server.
How do I fix CVE-2007-2697?
To fix CVE-2007-2697, implement proper authentication attempt limits and auditing within your WebLogic configurations.
Which versions are affected by CVE-2007-2697?
CVE-2007-2697 affects BEA WebLogic Express and WebLogic Server versions 7.0 through SP6, 8.1 through SP5, 9.0, and 9.1.
Can CVE-2007-2697 lead to unauthorized access?
Yes, CVE-2007-2697 can lead to unauthorized access if attackers exploit the lack of authentication attempt limits.
What should I monitor to mitigate CVE-2007-2697?
You should monitor authentication logs for unusual activity to mitigate the risks associated with CVE-2007-2697.
- agent/references
- agent/type
- agent/event
- agent/softwarecombine
- agent/last-modified-date
- agent/first-publish-date
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- agent/description
- agent/severity
- agent/remedy
- agent/author
- agent/weakness
- vendor/bea
- canonical/oracle weblogic server
- version/oracle weblogic server/7.0
- version/oracle weblogic server/7.0-sp1
- version/oracle weblogic server/7.0-sp2
- version/oracle weblogic server/7.0-sp3
- version/oracle weblogic server/7.0-sp4
- version/oracle weblogic server/7.0-sp5
- version/oracle weblogic server/7.0-sp6
- version/oracle weblogic server/7.0-sp7
- version/oracle weblogic server/8.1
- version/oracle weblogic server/8.1-sp1
- version/oracle weblogic server/8.1-sp2
- version/oracle weblogic server/8.1-sp3
- version/oracle weblogic server/8.1-sp4
- version/oracle weblogic server/8.1-sp5
- version/oracle weblogic server/9.0
- version/oracle weblogic server/9.0-ga
- version/oracle weblogic server/9.1
- version/oracle weblogic server/9.1-ga