Design/Logic Flaw

2008-02-2101:44:00

PRIOn knowledge base

www.prio-n.com

7.3 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

68.0%

JSON

Admin Tools in BEA WebLogic Portal 8.1 SP3 through SP6 can inadvertently remove entitlements for pages when an administrator edits the page definition label, which might allow remote attackers to bypass intended access restrictions.

CPENameOperatorVersion
weblogic_portaleq8.1.0-sp6
weblogic_portaleq8.1 sp3
weblogic_portaleq8.1 sp4
weblogic_portaleq8.1 sp5

Name	Operator	Version
weblogic_portal	eq	8.1.0-sp6
weblogic_portal	eq	8.1 sp3
weblogic_portal	eq	8.1 sp4
weblogic_portal	eq	8.1 sp5

References

dev2dev.bea.com/pub/advisory/256

secunia.com/advisories/29041

www.securitytracker.com/id?1019454

www.vupen.com/english/advisories/2008/0613