CVE-2007-2695

Severity: medium (CVSS 5.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-05-16 · updated 2026-06-16

Description

The HttpClusterServlet and HttpProxyServlet in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0, and 9.1, when SecureProxy is enabled, may process "external requests on behalf of a system identity," which allows remote attackers to access administrative data or functionality.

Affected products

Bea Weblogic Server: 6.1, 6.1-sp1, 6.1-sp2, 6.1-sp3, 6.1-sp4, 6.1-sp5 (+19)

References

http://dev2dev.bea.com/pub/advisory/227
http://dev2dev.bea.com/pub/advisory/274
http://osvdb.org/36074
http://secunia.com/advisories/25284
http://secunia.com/advisories/29041
http://securitytracker.com/id?1018057
http://www.vupen.com/english/advisories/2007/1815
http://www.vupen.com/english/advisories/2008/0612/references
https://exchange.xforce.ibmcloud.com/vulnerabilities/34282
http://dev2dev.bea.com/pub/advisory/227
http://dev2dev.bea.com/pub/advisory/274
http://osvdb.org/36074

Get alerted when CVE-2007-2695 or the next vulnerability affects your stack