CVE-2007-2695
Summary
| CVE | CVE-2007-2695 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2007-05-16 01:19:00 UTC |
| Updated | 2026-04-23 00:35:47 UTC |
| Description | The HttpClusterServlet and HttpProxyServlet in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0, and 9.1, when SecureProxy is enabled, may process "external requests on behalf of a system identity," which allows remote attackers to access administrative data or functionality. |
Risk And Classification
Primary CVSS: v2.0 5.1 from [email protected]
AV:N/AC:H/Au:N/C:P/I:P/A:P
Problem Types: NVD-CWE-Other | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
HighAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:H/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Bea | Weblogic Server | 6.1 | All | All | All |
| Application | Bea | Weblogic Server | 6.1 | All | express | All |
| Application | Bea | Weblogic Server | 6.1 | sp1 | All | All |
| Application | Bea | Weblogic Server | 6.1 | sp1 | express | All |
| Application | Bea | Weblogic Server | 6.1 | sp2 | All | All |
| Application | Bea | Weblogic Server | 6.1 | sp2 | express | All |
| Application | Bea | Weblogic Server | 6.1 | sp3 | All | All |
| Application | Bea | Weblogic Server | 6.1 | sp3 | express | All |
| Application | Bea | Weblogic Server | 6.1 | sp4 | All | All |
| Application | Bea | Weblogic Server | 6.1 | sp4 | express | All |
| Application | Bea | Weblogic Server | 6.1 | sp5 | All | All |
| Application | Bea | Weblogic Server | 6.1 | sp5 | express | All |
| Application | Bea | Weblogic Server | 6.1 | sp6 | All | All |
| Application | Bea | Weblogic Server | 6.1 | sp6 | express | All |
| Application | Bea | Weblogic Server | 6.1 | sp7 | All | All |
| Application | Bea | Weblogic Server | 6.1 | sp7 | express | All |
| Application | Bea | Weblogic Server | 7.0 | All | All | All |
| Application | Bea | Weblogic Server | 7.0 | All | express | All |
| Application | Bea | Weblogic Server | 7.0 | sp1 | All | All |
| Application | Bea | Weblogic Server | 7.0 | sp1 | express | All |
| Application | Bea | Weblogic Server | 7.0 | sp2 | All | All |
| Application | Bea | Weblogic Server | 7.0 | sp2 | express | All |
| Application | Bea | Weblogic Server | 7.0 | sp3 | All | All |
| Application | Bea | Weblogic Server | 7.0 | sp3 | express | All |
| Application | Bea | Weblogic Server | 7.0 | sp4 | All | All |
| Application | Bea | Weblogic Server | 7.0 | sp4 | express | All |
| Application | Bea | Weblogic Server | 7.0 | sp5 | All | All |
| Application | Bea | Weblogic Server | 7.0 | sp5 | express | All |
| Application | Bea | Weblogic Server | 7.0 | sp6 | All | All |
| Application | Bea | Weblogic Server | 7.0 | sp6 | express | All |
| Application | Bea | Weblogic Server | 7.0 | sp7 | All | All |
| Application | Bea | Weblogic Server | 7.0 | sp7 | express | All |
| Application | Bea | Weblogic Server | 8.1 | All | All | All |
| Application | Bea | Weblogic Server | 8.1 | All | express | All |
| Application | Bea | Weblogic Server | 8.1 | sp1 | All | All |
| Application | Bea | Weblogic Server | 8.1 | sp1 | express | All |
| Application | Bea | Weblogic Server | 8.1 | sp2 | All | All |
| Application | Bea | Weblogic Server | 8.1 | sp2 | express | All |
| Application | Bea | Weblogic Server | 8.1 | sp3 | All | All |
| Application | Bea | Weblogic Server | 8.1 | sp3 | express | All |
| Application | Bea | Weblogic Server | 8.1 | sp4 | All | All |
| Application | Bea | Weblogic Server | 8.1 | sp4 | express | All |
| Application | Bea | Weblogic Server | 8.1 | sp5 | All | All |
| Application | Bea | Weblogic Server | 8.1 | sp5 | express | All |
| Application | Bea | Weblogic Server | 9.0 | All | All | All |
| Application | Bea | Weblogic Server | 9.0 | All | express | All |
| Application | Bea | Weblogic Server | 9.1 | All | All | All |
| Application | Bea | Weblogic Server | 9.1 | ga | express | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| SecurityTracker.com Archives - BEA WebLogic Server Multiple Bugs Let Remote Users Deny Service, Gain Elevated Privileges | af854a3a-2127-422b-91ae-364da2661108 | securitytracker.com | Patch |
| osvdb.org/36074 | af854a3a-2127-422b-91ae-364da2661108 | osvdb.org | |
| Oracle Fusion Middleware Technologies | af854a3a-2127-422b-91ae-364da2661108 | dev2dev.bea.com | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| About Secunia Research | Flexera | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Oracle Fusion Middleware Technologies | af854a3a-2127-422b-91ae-364da2661108 | dev2dev.bea.com | |
| BEA Products Multiple Vulnerabilities - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Patch, Vendor Advisory |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.