FKIE_CVE-2007-2705

Vulnerability from fkie_nvd - Published: 2007-05-16 01:19 - Updated: 2025-04-09 00:30
Severity ?
Summary
Directory traversal vulnerability in the Test View Console in BEA WebLogic Integration 9.2 before SP1 and WebLogic Workshop 8.1 SP2 through SP6, when "deployed in an exploded format," allows remote attackers to list a WebLogic Workshop Directory (wlwdir) parent directory via unspecified vectors.
References
cve@mitre.orghttp://dev2dev.bea.com/pub/advisory/239Patch, Vendor Advisory
cve@mitre.orghttp://osvdb.org/36063
cve@mitre.orghttp://www.securitytracker.com/id?1018059
cve@mitre.orghttp://www.vupen.com/english/advisories/2007/1815
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/34281
af854a3a-2127-422b-91ae-364da2661108http://dev2dev.bea.com/pub/advisory/239Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/36063
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1018059
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2007/1815
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/34281
Impacted products
Vendor Product Version
bea weblogic_integration 9.2
bea weblogic_workshop 8.1
bea weblogic_workshop 8.1
bea weblogic_workshop 8.1
bea weblogic_workshop 8.1
bea weblogic_workshop 8.1
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:bea:weblogic_integration:9.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "C64003CF-C562-491A-8430-B8D40CEC528C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bea:weblogic_workshop:8.1:sp2:*:*:*:*:*:*",
              "matchCriteriaId": "AD6F9694-259F-4631-BC93-B1136F08E77E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bea:weblogic_workshop:8.1:sp3:*:*:*:*:*:*",
              "matchCriteriaId": "77624161-7740-4162-9C83-C0DFEA2BBCCC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bea:weblogic_workshop:8.1:sp4:*:*:*:*:*:*",
              "matchCriteriaId": "E785D039-3426-4C1F-BBA8-7C6D32FB141E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bea:weblogic_workshop:8.1:sp5:*:*:*:*:*:*",
              "matchCriteriaId": "D4B2A474-B6C4-47B6-8B20-8722A8C25238",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bea:weblogic_workshop:8.1:sp6:*:*:*:*:*:*",
              "matchCriteriaId": "2FDBD7AF-51AC-48B9-A465-0C13B9230EE3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Directory traversal vulnerability in the Test View Console in BEA WebLogic Integration 9.2 before SP1 and WebLogic Workshop 8.1 SP2 through SP6, when \"deployed in an exploded format,\" allows remote attackers to list a WebLogic Workshop Directory (wlwdir) parent directory via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de salto de directorio en Test View Console de BEA WebLogic Integration 9.2 anterior a SP1 y WebLogic Workshop 8.1 SP2 hasta SP6, cuando es \"desplegado en formato expandido\" permite a atacantes remotos listar un directorio padre de WebLogic Workshop Directory (wlwdir) a trav\u00e9s de vectores sin especificar."
    }
  ],
  "evaluatorSolution": "The vendor has addressed this issue through the following product releases: \r\n\r\nBEA WebLogic Server patches :\r\nhttp://commerce.bea.com/showallversions.jsp?family=WLS\r\n\r\nBEA WebLogic Platform patches :\r\nhttp://commerce.bea.com/showallversions.jsp?family=WLP \r\n",
  "id": "CVE-2007-2705",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 7.8,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2007-05-16T01:19:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://dev2dev.bea.com/pub/advisory/239"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/36063"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id?1018059"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2007/1815"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34281"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://dev2dev.bea.com/pub/advisory/239"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/36063"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1018059"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2007/1815"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34281"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.