Kylinking

Name of the Vulnerable Software and Affected Versions: IBM WebSphere Application Server versions 7.0 through 8.5 Description: The issue allows a remote authenticated attacker to obtain sensitive data by sending a specially crafted request, exploiting a server-side request forgery (SSRF) weakness. Recommendations: For versions 7.0 through 8.5, update to a version that includes a fix for this issue to prevent exploitation.

The issue is related to insufficient input validation in the Oracle WebLogic Server, allowing a remote attacker to execute arbitrary code via the IIOP protocol. This can result in the takeover of the Oracle WebLogic Server. The vulnerability can be easily exploited by an unauthenticated attacker with network access.

The issue allows a remote attacker to expose sensitive information through an XML External Entity Injection (XXE) attack when processing XML data.

The issue is related to insufficient access control in the WLS Core Components of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via the IIOP protocol to compromise the server. Successful attacks can result in the takeover of Oracle WebLogic Server.