CVE-2007-2699

Published: May 16, 2007Modified: Apr 23, 2026

7.1

Vector

AV:N/AC:H/Au:S/C:C/I:C/A:C

Exploitability: 3.9 / Impact: 10.0

Source: NVD

Description

The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce certain Domain Security Policies, which allows remote administrative users in the Deployer role to upload arbitrary files.

Affected (4)

Products: Bea: Weblogic Server

Bea

1 product

Weblogic Server

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Bea Weblogic Server	Version 9.0
Bea Weblogic Server	Version 9.0
Bea Weblogic Server	Version 9.1
Bea Weblogic Server	Version 9.1

References (14)

http://dev2dev.bea.com/pub/advisory/231

Source: cve@mitre.org

PatchVendor Advisory

http://osvdb.org/36069

Source: cve@mitre.org

http://packetstormsecurity.com/files/153072/Oracle-Application-Testing-Suite-WebLogic-Server-Administration-Console-War-Deployment.html

Source: cve@mitre.org

http://secunia.com/advisories/25284

Source: cve@mitre.org

Vendor Advisory

http://securitytracker.com/id?1018057

Source: cve@mitre.org

Patch

http://www.vupen.com/english/advisories/2007/1815

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/34289

Source: cve@mitre.org

http://dev2dev.bea.com/pub/advisory/231