6.8med
CVE-2007-4613
SSL libraries in BEA WebLogic Server 6.1 Gold through SP7, 7.0 Gold through SP7, and 8.1 Gold through SP5 might allow remote attackers to o…
Published 19 y ago · modified 4 mo ago · JSON
CVSS
6.8
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.4%
percentile 72%
Public exploits
0
none known
Summary
SSL libraries in BEA WebLogic Server 6.1 Gold through SP7, 7.0 Gold through SP7, and 8.1 Gold through SP5 might allow remote attackers to obtain plaintext from an SSL stream via a man-in-the-middle attack that injects crafted data and measures the elapsed time before an error response, a different vulnerability than CVE-2006-2461.
Exploit prediction (EPSS)
1.35% probability of exploitation in the next 30 days, higher than 72% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Classification
- Weakness
- CWE-310 Cryptographic Issues
References
- securityfocus.com /bid/22082 · vdb-entry, x_refsource_BID, x_transferred
- dev2dev.bea.com /pub/advisory/201 · vendor-advisory, x_refsource_BEA, x_transferred
- osvdb.org /45838 · vdb-entry, x_refsource_OSVDB, x_transferred
Sources
- CVE List: CVE-2007-4613
- NVD: CVE-2007-4613
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.