Test ID:	1.3.6.1.4.1.25623.1.0.802446
Category:	Web Servers
Title:	Oracle WebLogic Server Multiple Security Bypass Vulnerabilities
Summary:	Oracle WebLogic Server is prone to multiple security bypass vulnerabilities.
Description:	Summary: Oracle WebLogic Server is prone to multiple security bypass vulnerabilities. Vulnerability Insight: - Soap interface exposes the 'deleteFile' function which could allow to delete arbitrary files with administrative privileges on the target server through a directory traversal vulnerability. - A web service called 'FlashTunnelService' which can be reached without prior authentication and processes incoming SOAP requests. Vulnerability Impact: Successful exploitation could allow attackers to execute arbitrary code under the context of the application. Affected Software/OS: Oracle WebLogic Server version 12c (12.1.1). Solution: No known solution was made available for at least one year since the disclosure of this vulnerability. Likely none will be provided anymore. General solution options are to upgrade to a newer release, disable respective features, remove the product or replace the product by another one. CVSS Score: 5.7 CVSS Vector: AV:A/AC:M/Au:N/C:N/I:N/A:C
Copyright	Copyright (C) 2012 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.