BEA WebLogic Portal Access Validation Vulnerability

Bugtraq ID:	14632
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 22 2005 12:00AM
Updated:	Aug 22 2005 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	BEA Systems WebLogic Portal 8.1 SP4 BEA Systems WebLogic Portal 8.1 SP3 BEA Systems WebLogic Portal 8.1 SP2 BEA Systems WebLogic Portal 8.1 SP1 BEA Systems WebLogic Portal 8.1
Not Vulnerable:

BEA WebLogic Portal Access Validation Vulnerability

BEA WebLogic Portal is affected by an access validation vulnerability.

An attacker can gain access to restricted content including all pages of the Book by issuing a specially crafted HTTP GET request.

WebLogic Portal 8.1 Service Pack 4 and prior are affected by this vulnerability.

BEA WebLogic Portal Access Validation Vulnerability

An exploit is not required.

BEA WebLogic Portal Access Validation Vulnerability

Solution:
The vendor has released a patch for WebLogic Portal 8.1 Service Pack 4.


BEA Systems WebLogic Portal 8.1 SP4

• BEA Systems patch_CR238578_81SP4.zip
  ftp://ftpna.beasys.com/pub/releases/security/patch_CR238578_81SP4.zip

BEA WebLogic Portal Access Validation Vulnerability

References:

• Security Advisory: (BEA05-84.00) (BEA Systems)
  
• WebLogic Portal Product Page (BEA Systems)