PT-2005-5424 · Bea · Oracle Weblogic Server+1

Publicado 2005-12-31 · Atualizado 2008-09-05 · CVE-2005-4761

Positive Technologies (AI Summary)

CVSS v2.0

1.2

Baixa

Vetor base

AV:L/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server and WebLogic Express versions 8.1 SP4 and earlier BEA WebLogic Server and WebLogic Express versions 7.0 SP5 and earlier BEA WebLogic Server and WebLogic Express versions 6.1 SP7 and earlier

Description The software logs the Java command line at server startup, potentially including sensitive information such as passwords or keyphrases in the server log file when the -D option is used.

Recommendations For versions 8.1 SP4 and earlier, consider removing or restricting access to the server log file to minimize exposure of sensitive information. For versions 7.0 SP5 and earlier, avoid using the -D option to prevent logging of sensitive data. For versions 6.1 SP7 and earlier, restrict access to the server log file and consider alternative logging configurations to reduce the risk of sensitive information disclosure.

Correção

Identificadores relacionados

CVE-2005-4761

Produtos afetados

Weblogic Express

Oracle Weblogic Server

Referências · 5

• http://secunia.com/advisories/17138 · Aviso do Fabricante
• http://securityfocus.com/bid/15052 · Correção
• http://dev2dev.bea.com/pub/advisory/152 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-4761 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4761 · Nota