Lucene search
HistoryJan 23, 2007 - 12:28 a.m.
CVE-2007-0416
cve-2007-0416
wsee runtime
bea weblogic server
ws-security runtime
application security
remote attackers
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
6.7 Medium
AI Score
Confidence
Low
0.271 Low
EPSS
Percentile
96.8%
The WSEE runtime (WS-Security runtime) in BEA WebLogic Server 9.0 and 9.1 does not verify credentials when decrypting client messages, which allows remote attackers to bypass application security.
Affected configurations
Node
beaweblogic_serverMatch9.0
ORbeaweblogic_serverMatch9.1
| CPE | Name | Operator | Version |
|---|---|---|---|
| bea:weblogic_server | bea weblogic server | eq | 9.0 |
| bea:weblogic_server | bea weblogic server | eq | 9.1 |
Related
cvelist
cvelist
CVE-2007-0416
2007-01-23 00:00:00
nvd
nvd
CVE-2007-0416
2007-01-23 00:28:00
prion
prion
Authentication flaw
2007-01-23 00:28:00
securityvulns
securityvulns
BEA WebLogic / AquaLogic multiple security vulnerabilities
2007-02-02 00:00:00
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
6.7 Medium
AI Score
Confidence
Low
0.271 Low
EPSS
Percentile
96.8%
Related for CVE-2007-0416