1. CVE-Search
  2. CVE-2007-2695
ID CVE-2007-2695
Summary The HttpClusterServlet and HttpProxyServlet in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0, and 9.1, when SecureProxy is enabled, may process "external requests on behalf of a system identity," which allows remote attackers to access administrative data or functionality.
References
Vulnerable Configurations
  • cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:6.1:sp6:express:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:6.1:sp6:express:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:6.1:sp7:express:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:6.1:sp7:express:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:7.0:sp6:express:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:7.0:sp6:express:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:7.0:sp7:*:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:7.0:sp7:*:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:7.0:sp7:express:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:7.0:sp7:express:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:8.1:sp5:express:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:8.1:sp5:express:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:9.0:*:express:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:9.0:*:express:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*
  • cpe:2.3:a:bea:weblogic_server:9.1:ga:express:*:*:*:*:*
    cpe:2.3:a:bea:weblogic_server:9.1:ga:express:*:*:*:*:*
CVSS
Base: 5.1 (as of 29-07-2017 - 01:31)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK HIGH NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:H/Au:N/C:P/I:P/A:P
refmap via4
bea
  • BEA07-159.00
  • BEA08-159.01
osvdb 36074
sectrack 1018057
secunia
  • 25284
  • 29041
vupen
  • ADV-2007-1815
  • ADV-2008-0612
xf weblogic-servlet-unauthorized-access(34282)
Last major update 29-07-2017 - 01:31
Published 16-05-2007 - 01:19
Last modified 29-07-2017 - 01:31
Back to Top