Lucene search

[email protected]CVE-2007-0418

HistoryJan 23, 2007 - 12:28 a.m.

CVE-2007-0418

2007-01-2300:28:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

cve-2007-0418

weblogic server

security policy

ejb methods

remote attackers

unauthorized access

7 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.044 Low

EPSS

Percentile

92.3%

JSON

BEA WebLogic Server 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9.0, and 9.1 does not enforce a security policy that declares permissions for EJB methods that have array parameters, which allows remote attackers to obtain unauthorized access to these methods.

CPENameOperatorVersion
bea:weblogic_serverbea weblogic serverle8.1
bea:weblogic_serverbea weblogic servereq9.0
bea:weblogic_serverbea weblogic servereq7.0
bea:weblogic_serverbea weblogic servereq9.1

CPE	Name	Operator	Version
bea:weblogic_server	bea weblogic server	le	8.1
bea:weblogic_server	bea weblogic server	eq	9.0
bea:weblogic_server	bea weblogic server	eq	7.0
bea:weblogic_server	bea weblogic server	eq	9.1

References

dev2dev.bea.com/pub/advisory/212

osvdb.org/38512

secunia.com/advisories/23750

securitytracker.com/id?1017525

www.securityfocus.com/bid/22082

www.vupen.com/english/advisories/2007/0213

7 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.044 Low

EPSS

Percentile

92.3%

JSON

Related for CVE-2007-0418

prion1 securityvulns1