PT-2006-3492 · Bea · Bea Weblogic Server

Publicado 2006-05-23 · Atualizado 2017-07-20 · CVE-2006-2546

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server version 8.1

Description A password reset mechanism in BEA WebLogic Server, when used before October 10, 2005, stores the administrator password in cleartext in the domain directory. This could allow attackers to gain privileges.

Recommendations For BEA WebLogic Server version 8.1, consider resetting the admin password using a secure method to avoid storing it in cleartext. As a temporary workaround, restrict access to the domain directory to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-2546

Produtos afetados

Bea Weblogic Server

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2006-2546 · Nota de Segurança
• http://vupen.com/english/advisories/2006/1828 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26460 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2546 · Nota
• http://securitytracker.com/id?1016101 · Nota
• http://secunia.com/advisories/20130 · Aviso do Fabricante
• http://dev2dev.bea.com/pub/advisory/193 · Aviso do Fabricante