CVE-2007-2696 : The JMS Server in BEA WebLogic Server 6.1 through SP7, 7.0 through SP6, and 8.1

The JMS Server in BEA WebLogic Server 6.1 through SP7, 7.0 through SP6, and 8.1 through SP5 enforces security access policies on the front end, which allows remote attackers to access protected queues via direct requests to the JMS back-end server.

Published 2007-05-16 01:19:00

Updated 2017-07-29 01:31:40

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2007-2696

BEA » Weblogic Server » Version: 6.1
cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 6.1 Update SP1
cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 6.1 Update SP3
cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 6.1 Update SP2
cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0
cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP2
cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 6.1 Update SP4
cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP1
cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP3
cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP3
cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 6.1 Update SP6
cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 6.1 Update SP5
cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP5
cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP2
cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP4
cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP1
cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP4
cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1
cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP6
cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 6.1 Update SP7
cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP5
cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2007-2696

EPSS FAQ

4.10%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 92 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2007-2696

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P	8.6	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

References for CVE-2007-2696

http://dev2dev.bea.com/pub/advisory/228

Patch;Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/34284
http://securitytracker.com/id?1018057

CVEs referencing this url
http://www.vupen.com/english/advisories/2007/1815

Site en construction

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2007-2696

Products affected by CVE-2007-2696

Exploit prediction scoring system (EPSS) score for CVE-2007-2696

CVSS scores for CVE-2007-2696

References for CVE-2007-2696