Total vulnerabilities in the database
The remove method in a stateful Enterprise JavaBean (EJB) in BEA WebLogic Server and WebLogic Express version 8.1 through SP2, 7.0 through SP4, and 6.1 through SP6, does not properly check EJB permissions before unexporting a bean, which allows remote authenticated users to remove EJB objects from remote views before the security exception is thrown.
| Software | From | Fixed in |
|---|---|---|
| bea / weblogic_server | 8.1 | 8.1.x |
| bea / weblogic_server | 7.0-sp2 | 7.0-sp2.x |
| bea / weblogic_server | 6.1-sp4 | 6.1-sp4.x |
| bea / weblogic_server | 6.1 | 6.1.x |
| bea / weblogic_server | 6.1-sp5 | 6.1-sp5.x |
| bea / weblogic_server | 6.1-sp6 | 6.1-sp6.x |
| bea / weblogic_server | 7.0-sp4 | 7.0-sp4.x |
| bea / weblogic_server | 6.1-sp1 | 6.1-sp1.x |
| bea / weblogic_server | 7.0 | 7.0.x |
| bea / weblogic_server | 6.1-sp3 | 6.1-sp3.x |
| bea / weblogic_server | 7.0-sp3 | 7.0-sp3.x |
| bea / weblogic_server | 8.1-sp1 | 8.1-sp1.x |
| bea / weblogic_server | 6.1-sp2 | 6.1-sp2.x |
| bea / weblogic_server | 8.1-sp2 | 8.1-sp2.x |
| bea / weblogic_server | 7.0-sp1 | 7.0-sp1.x |