CVE-2007-4616

MEDIUM 6.4CVE-2007-4616 · Published 31/08/2007 · updated 16/06/2026

Package	Affected versions	Patched versions
weblogic server bea	`= 10.0= 7.0= 8.1= 9.0= 9.1= 9.2`	No fix yet

Description

The SSL server implementation in BEA WebLogic Server 7.0 Gold through SP7, 8.1 Gold through SP6, 9.0, 9.1, 9.2 Gold through MP1, and 10.0 sometimes selects the null cipher when no other cipher is compatible between the server and client, which might allow remote attackers to intercept communications.

References

dev2dev.bea.com/pub/advisory/245 · Patch
secunia.com/advisories/26539 · Patch
securitytracker.com/id · Third Party Advisory
securityfocus.com/bid/25472 · Third Party Advisory
vupen.com/english/advisories/2007/3008 · Third Party Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/36320 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free