CVE-2007-2699
BEA WebLogic Express/WebLogic Server 9.0-9.1 - Privilege Escalation
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2007-2699.
PoCs published by Steven Seeley, sinn3r, including Metasploit module exploits/windows/http/oats_weblogic_console.
AI-analyzed exploit summary This Metasploit module exploits a feature in Oracle WebLogic Server's Administration Console to deploy a malicious WAR file, achieving remote code execution. It leverages default credentials ('oats') for authentication and targets versions 12 or prior.
Description
The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce certain Domain Security Policies, which allows remote administrative users in the Deployer role to upload arbitrary files.
Exploits (1)
This Metasploit module exploits a feature in Oracle WebLogic Server's Administration Console to deploy a malicious WAR file, achieving remote code execution. It leverages default credentials ('oats') for authentication and targets versions 12 or prior.