CVE-2007-0412

BEA WebLogic Server 6.1 through 6.1 SP7, 7.0 through 7.0 SP7, and 8.1 through 8.1 SP5 allows remote attackers to read arbitrary files inside the class-path property via .ear or exploded .ear files that use the manifest class-path property to point to utility jar files.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://dev2dev.bea.com/pub/advisory/206	Patch Vendor Advisory
http://osvdb.org/38505	Broken Link
http://secunia.com/advisories/23750	Third Party Advisory
http://securitytracker.com/id?1017525	Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/22082	Third Party Advisory VDB Entry
http://www.vupen.com/english/advisories/2007/0213	Third Party Advisory
http://dev2dev.bea.com/pub/advisory/206	Patch Vendor Advisory
http://osvdb.org/38505	Broken Link
http://secunia.com/advisories/23750	Third Party Advisory
http://securitytracker.com/id?1017525	Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/22082	Third Party Advisory VDB Entry
http://www.vupen.com/english/advisories/2007/0213	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:bea:weblogic_server:6.1:::::::*
	cpe:2.3:a:bea:weblogic_server:6.1:sp1::::::
	cpe:2.3:a:bea:weblogic_server:6.1:sp2::::::
	cpe:2.3:a:bea:weblogic_server:6.1:sp3::::::
	cpe:2.3:a:bea:weblogic_server:6.1:sp4::::::
	cpe:2.3:a:bea:weblogic_server:6.1:sp5::::::
	cpe:2.3:a:bea:weblogic_server:6.1:sp6::::::
	cpe:2.3:a:bea:weblogic_server:6.1:sp7::::::
	cpe:2.3:a:bea:weblogic_server:7.0:::::::*
	cpe:2.3:a:bea:weblogic_server:7.0:sp1::::::
	cpe:2.3:a:bea:weblogic_server:7.0:sp2::::::
	cpe:2.3:a:bea:weblogic_server:7.0:sp3::::::
	cpe:2.3:a:bea:weblogic_server:7.0:sp4::::::
	cpe:2.3:a:bea:weblogic_server:7.0:sp5::::::
	cpe:2.3:a:bea:weblogic_server:7.0:sp6::::::
	cpe:2.3:a:bea:weblogic_server:7.0:sp7::::::
	cpe:2.3:a:bea:weblogic_server:8.1:::::::*
	cpe:2.3:a:bea:weblogic_server:8.1:sp1::::::
	cpe:2.3:a:bea:weblogic_server:8.1:sp2::::::
	cpe:2.3:a:bea:weblogic_server:8.1:sp3::::::
	cpe:2.3:a:bea:weblogic_server:8.1:sp4::::::
	cpe:2.3:a:bea:weblogic_server:8.1:sp5::::::

History

21 Nov 2024, 00:25

Type	Values Removed	Values Added
References	~~() http://dev2dev.bea.com/pub/advisory/206 - Patch, Vendor Advisory~~	() http://dev2dev.bea.com/pub/advisory/206 - Patch, Vendor Advisory
References	~~() http://osvdb.org/38505 - Broken Link~~	() http://osvdb.org/38505 - Broken Link
References	~~() http://secunia.com/advisories/23750 - Third Party Advisory~~	() http://secunia.com/advisories/23750 - Third Party Advisory
References	~~() http://securitytracker.com/id?1017525 - Third Party Advisory, VDB Entry~~	() http://securitytracker.com/id?1017525 - Third Party Advisory, VDB Entry
References	~~() http://www.securityfocus.com/bid/22082 - Third Party Advisory, VDB Entry~~	() http://www.securityfocus.com/bid/22082 - Third Party Advisory, VDB Entry
References	~~() http://www.vupen.com/english/advisories/2007/0213 - Third Party Advisory~~	() http://www.vupen.com/english/advisories/2007/0213 - Third Party Advisory

Information

Published : 2007-01-23 00:28

Updated : 2024-11-21 00:25

NVD link : CVE-2007-0412

Mitre link : CVE-2007-0412

CVE.ORG link : CVE-2007-0412

JSON object : View

Products Affected

bea

weblogic_server

CWE

NVD-CWE-Other

{"id": "CVE-2007-0412", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2007-01-23T00:28:00.000", "references": [{"url": "http://dev2dev.bea.com/pub/advisory/206", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://osvdb.org/38505", "tags": ["Broken Link"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/23750", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id?1017525", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/22082", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2007/0213", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://dev2dev.bea.com/pub/advisory/206", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://osvdb.org/38505", "tags": ["Broken Link"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/23750", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://securitytracker.com/id?1017525", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/22082", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.vupen.com/english/advisories/2007/0213", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "BEA WebLogic Server 6.1 through 6.1 SP7, 7.0 through 7.0 SP7, and 8.1 through 8.1 SP5 allows remote attackers to read arbitrary files inside the class-path property via .ear or exploded .ear files that use the manifest class-path property to point to utility jar files."}, {"lang": "es", "value": "BEA WebLogic Server 6.1 hasta 6.1 SP7, 7.0 hasta 7.0 SP7, y 8.1 hasta 8.1 SP5 permite a atacantes remotos leer archivos de su elecci\u00f3n dentro de la propiedad class-path a trav\u00e9s de .ear o explotar los archivos .ear que utiliza el manifiesto class-path adecuadamente para idnicar el uso de achivos .jar"}], "lastModified": "2024-11-21T00:25:47.987", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C4DACAC1-ABEC-4310-A0FF-B69EF9BCF273"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F5D61A68-E83A-4374-832A-C9A2FEA0AD6C"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2A489A8E-D3AE-42DF-8DCF-5A9EF10778FA"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}

5.0 /10