PT-2007-1880 · Bea · Bea Weblogic

Publicado 2007-01-23 · Atualizado 2011-03-08 · CVE-2007-0409

Positive Technologies (AI Summary)

CVSS v2.0

1.5

Baixa

Vetor base

AV:L/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic versions 7.0 through 7.0 SP6 BEA WebLogic versions 8.1 through 8.1 SP4 BEA WebLogic version 9.0 initial release

Description The issue allows local administrative users to read cleartext passwords stored in the JDBCDataSourceFactory MBean Properties due to a lack of encryption.

Recommendations For BEA WebLogic versions 7.0 through 7.0 SP6, consider restricting access to the JDBCDataSourceFactory MBean Properties to minimize the risk of exploitation. For BEA WebLogic versions 8.1 through 8.1 SP4, consider restricting access to the JDBCDataSourceFactory MBean Properties to minimize the risk of exploitation. For BEA WebLogic version 9.0 initial release, consider restricting access to the JDBCDataSourceFactory MBean Properties to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2007-0409

Produtos afetados

Bea Weblogic

Referências · 8

• http://dev2dev.bea.com/pub/advisory/203 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0409 · Nota
• http://secunia.com/advisories/23750 · Nota
• http://vupen.com/english/advisories/2007/0213 · Nota
• http://securityfocus.com/bid/22082 · Nota
• http://osvdb.org/38501 · Nota
• http://securitytracker.com/id?1017525 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-0409 · Nota de Segurança