Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.1

WebLogic Server admin console lets deployer upload any file

CVE-2007-2699 · published 19 years ago
Summary

In WebLogic Server versions 9.0 and 9.1, the admin console does not correctly apply some security rules. This means a user with the Deploy role can place any file on the server, potentially leading to malicious code being installed. Apply the vendor's security update or restrict the Deploy role to trusted users to mitigate the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
bea weblogic_server 9.0
9.1
cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*
Original advisory text
The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce certain Domain Security Policies, which allows remote administrative users in the Deploy...
The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce certain Domain Security Policies, which allows remote administrative users in the Deployer role to upload arbitrary files.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.1 High
Exploitation
29% chance of attack within 30 days
Timeline
Published16 May 2007
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2007-2699 · NVD
Track software like this
Free during beta