CVE-2007-0426

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

BEA WebLogic Portal 9.2, when running in a WebLogic Server clustered environment using WebLogic Portal entitlements, does not properly propagate entitlement policy changes if the changes are made on a managed server while the Administrative Server is unavailable, which might allow attackers to bypass intended restrictions.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://dev2dev.bea.com/pub/advisory/223Patch, Vendor Advisory
http://osvdb.org/32854
http://osvdb.org/38516
http://secunia.com/advisories/23750Vendor Advisory
http://securitytracker.com/id?1017521
http://www.securityfocus.com/bid/22082
http://www.vupen.com/english/advisories/2007/0213
http://dev2dev.bea.com/pub/advisory/223Patch, Vendor Advisory
http://osvdb.org/32854
http://osvdb.org/38516
http://secunia.com/advisories/23750Vendor Advisory
http://securitytracker.com/id?1017521
http://www.securityfocus.com/bid/22082
http://www.vupen.com/english/advisories/2007/0213

Timeline

Published: Jan 23, 2007
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2007

CVE-2007-04279.3Stack-based buffer overflow in Microsoft Help Workshop 4.03.0002 allows user-assisted remote attackers to execute arbitrary code via a help CVE-2007-04285.0Unspecified vulnerability in the chtbl_lookup function in hash.c for WzdFTPD 8.0 and earlier allows remote attackers to cause a denial of se CVE-2007-04295.0DivXBrowserPlugin (aka DivX Web Player) npdivx32.dll, as distributed with DivX Player 6.4.1, allows remote attackers to cause a denial of se CVE-2007-04304.9The shared_region_map_file_np function in Apple Mac OS X 10.4.8 and earlier kernel allows local users to cause a denial of service (memory c CVE-2007-04317.8AVM Fritz!Box 7050, and possibly other product models, allows remote attackers to cause a denial of service (VoIP application crash) via a z CVE-2007-04327.5BEA AquaLogic Service Bus 2.0, 2.1, and 2.5 does not properly reject malformed request messages to a proxy service, which might allow remote CVE-2007-04336.5Unspecified vulnerability in BEA AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2.2, when using Active Director CVE-2007-04344.6BEA AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2.2 does not properly set the severity level of audit events CVE-2007-04357.5T-Com Speedport 500V routers with firmware 1.31 allow remote attackers to bypass authentication and reconfigure the device via a LOGINKEY=TE CVE-2007-04364.6Barron McCann X-Kryptor Driver BMS1446HRR (Xgntr BMS1351 Install BMS1472) in X-Kryptor Secure Client does not drop privileges when launching CVE-2007-04373.5Multiple cross-site scripting (XSS) vulnerabilities in the sample Cache' Server Page (CSP) scripts in InterSystems Cache' allow remote attac CVE-2007-04415.1Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 6.20, 6.4x, 7.01, and 7.50 allows remote attackers to execute arbitra