FKIE_CVE-2007-0426

Vulnerability from fkie_nvd - Published: 2007-01-23 00:28 - Updated: 2025-04-09 00:30
Severity ?
Summary
BEA WebLogic Portal 9.2, when running in a WebLogic Server clustered environment using WebLogic Portal entitlements, does not properly propagate entitlement policy changes if the changes are made on a managed server while the Administrative Server is unavailable, which might allow attackers to bypass intended restrictions.
References
cve@mitre.orghttp://dev2dev.bea.com/pub/advisory/223Patch, Vendor Advisory
cve@mitre.orghttp://osvdb.org/32854
cve@mitre.orghttp://osvdb.org/38516
cve@mitre.orghttp://secunia.com/advisories/23750Vendor Advisory
cve@mitre.orghttp://securitytracker.com/id?1017521
cve@mitre.orghttp://www.securityfocus.com/bid/22082
cve@mitre.orghttp://www.vupen.com/english/advisories/2007/0213
af854a3a-2127-422b-91ae-364da2661108http://dev2dev.bea.com/pub/advisory/223Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/32854
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/38516
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/23750Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1017521
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/22082
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2007/0213
Impacted products
Vendor Product Version
oracle weblogic_portal 9.2
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:weblogic_portal:9.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "B04835B2-7FE9-462B-B989-4031D43C9670",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "BEA WebLogic Portal 9.2, when running in a WebLogic Server clustered environment using WebLogic Portal entitlements, does not properly propagate entitlement policy changes if the changes are made on a managed server while the Administrative Server is unavailable, which might allow attackers to bypass intended restrictions."
    },
    {
      "lang": "es",
      "value": "BEA WebLogic Portal 9.2, cuando se ejecuta en un entorno de cl\u00faster de Servidores WebLogic utilizando derechos de Portal WebLogic, no propaga adecuadamente los cambios de pol\u00edticas de derechos si los cambios se hacen en un servidor gestionado mientras que el Servidor Administrativo no se encuentra disponible, lo cual podr\u00eda permitir a atacantes evitar restricciones pretendidas."
    }
  ],
  "id": "CVE-2007-0426",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2007-01-23T00:28:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://dev2dev.bea.com/pub/advisory/223"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/32854"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/38516"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/23750"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securitytracker.com/id?1017521"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/22082"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2007/0213"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://dev2dev.bea.com/pub/advisory/223"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/32854"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/38516"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/23750"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securitytracker.com/id?1017521"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/22082"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2007/0213"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.