PT-2005-2717 · Bea · Bea Weblogic Portal

Publicado 2005-05-24 · Atualizado 2018-10-30 · CVE-2005-1745

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BEA WebLogic Portal versions 8.1 through 8.1 Service Pack 3

Description The issue allows an attacker to potentially guess the correct password by exploiting a feature in the UserLogin control. When an incorrect login attempt is made, the password is printed to standard output, making it easier for attackers to obtain the password.

Recommendations For BEA WebLogic Portal versions 8.1 through 8.1 Service Pack 3, consider modifying the UserLogin control to prevent printing the password to standard output when an incorrect login attempt is made. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2005-1745

Produtos afetados

Bea Weblogic Portal

Referências · 7

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1745 · Nota
• http://securityfocus.com/bid/13717 · Nota
• http://securitytracker.com/id?1014049 · Nota
• http://dev2dev.bea.com/pub/advisory/128 · Aviso do Fabricante
• http://secunia.com/advisories/15486 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-1745 · Nota de Segurança
• http://vupen.com/english/advisories/2005/0605 · Nota