Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2007-4616: BEA WebLogic Server can use no‑encryption mode

CVE-2007-4616 · published 19 years ago

Summary

Certain versions of BEA WebLogic Server may fall back to a "null cipher" when it cannot find a matching encryption method with a client. This means data could be sent without any protection, allowing eavesdroppers to read the traffic. Update the server or apply the vendor's patch to ensure only encrypted connections are allowed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
bea	weblogic_server	7.0 8.1 9.0 9.1 9.2 10.0 `cpe:2.3:a:bea:weblogic_server:7.0:::::::*`

Original advisory text

The SSL server implementation in BEA WebLogic Server 7.0 Gold through SP7, 8.1 Gold through SP6, 9.0, 9.1, 9.2 Gold through MP1, and 10.0 sometimes selects the null cipher when no other cipher is compatible between the server and client, which might allow remote attackers to intercept communications.

References

http://dev2dev.bea.com/pub/advisory/245 Patch
http://secunia.com/advisories/26539 Patch Vendor Advisory
http://securitytracker.com/id?1018620 Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/25472 Third Party Advisory VDB Entry
http://www.vupen.com/english/advisories/2007/3008 Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/36320 Third Party Advisory VDB Entry

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

6.4 Medium

Exploitation

2% chance of attack within 30 days

Timeline

Published31 Aug 2007

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2007-4616 · NVD

Track software like this

Free during beta