BEA WebLogic Workshop and WebLogic Integration Test View Console directory traversal
| weblogic-testview-directory-traversal (34281) |  Medium Risk |
Description:
BEA WebLogic Workshop and WebLogic Integration could allow a remote attacker to traverse directories on the system, caused by an error that can occur under certain circumstances. An attacker could send a specially-crafted request to the Test View Console containing "dot dot" sequences (/../) to list parent directories to the WebLogic Workshop Directory (wlwdir).
Platforms Affected:
- BEA, WebLogic Integration 9.2
- BEA, WebLogic Workshop 8.1 SP4
- BEA, WebLogic Workshop 8.1 SP2
- BEA, WebLogic Workshop 8.1 SP3
- BEA, WebLogic Workshop 8.1 SP6
- BEA, WebLogic Workshop 8.1 SP5
Remedy:
Refer to BEA07-170.00 for patch and upgrade information. See References.
Consequences:
Obtain Information
References:
- BEA07-170.00, Exposure of filenames in development mode at https://support.bea.com/application_content/product_portlets/securityadvisories/239.html.
- BID-23979: Multiple BEA WebLogic Applications Multiple Vulnerabilities
- CVE-2007-2705: Directory traversal vulnerability in the Test View Console in BEA WebLogic Integration 9.2 before SP1 and WebLogic Workshop 8.1 SP2 through SP6, when deployed in an exploded format
- SECTRACK ID: 1018059: BEA WebLogic Integration Directory Traversal Bug Lets Remote Users List Certain Directories
- VUPEN/ADV-2007-1815: BEA Products Multiple Security Bypass and Information Disclosure Vulnerabilities
Reported:
May 14, 2007
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net