CVE-2007-2700: Medium severity Bea WebLogic Server vulnerability
Published May 16, 2007
·Updated
The WLST script generated by the configToScript command in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not encrypt certain attributes in configuration files when creating a new domain, which allows remote authenticated users to obtain sensitive information.
Affected Software
4 affected components
Bea WebLogic Server=9.0
Bea WebLogic Server=9.1
Bea WebLogic Server=9.0
Bea WebLogic Server=9.1
Event History
May 16, 2007
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2007-2700?
CVE-2007-2700 has been classified as a moderate severity vulnerability.
2
How do I fix CVE-2007-2700?
To fix CVE-2007-2700, ensure you upgrade to a patched version of Oracle WebLogic Server beyond 9.1.
3
What types of sensitive information can be exposed by CVE-2007-2700?
CVE-2007-2700 can potentially expose unencrypted usernames, passwords, and other sensitive configuration attributes.
4
Who can exploit the CVE-2007-2700 vulnerability?
Remote authenticated users can exploit the CVE-2007-2700 vulnerability to access sensitive information.
5
Which versions of Oracle WebLogic Server are affected by CVE-2007-2700?
CVE-2007-2700 affects Oracle WebLogic Server versions 9.0 and 9.1.