Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
BEA WebLogic Server and WebLogic Express 8.1 SP2 and earlier, and 7.0 SP4 and earlier, when using 2-way SSL with a custom trust manager, may accept a certificate chain even if the trust manager rejects it, which allows remote attackers to spoof other users or servers.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
BEA WebLogic Server和WebLogic Express证书链用户假冒漏洞
Vulnerability Description
BEA Systems WebLogic包含多种应用系统集成方案，包括Server/Express/Integration等。 BEA WebLogic Server和WebLogic Express验证证书链时存在问题，远程攻击者可以利用这个漏洞伪造管理员或远程服务器。 如果证书链验证有效并接收，但定制信任管理器(custom trust manager)拒绝此链，证书链仍旧能被接收，这个环境下允许攻击者使用双向SSL来伪造用户，当使用外出的SSL时，攻击者可以伪造远程服务器。目前没有详细漏洞细节提供。
CVSS Information
N/A
Vulnerability Type
N/A