PT-2005-2717 · Bea · Bea Weblogic Portal

Published 2005-05-24 · Updated 2018-10-30 · CVE-2005-1745

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BEA WebLogic Portal versions 8.1 through 8.1 Service Pack 3

Description The issue allows an attacker to potentially guess the correct password by exploiting a feature in the UserLogin control. When an incorrect login attempt is made, the password is printed to standard output, making it easier for attackers to obtain the password.

Recommendations For BEA WebLogic Portal versions 8.1 through 8.1 Service Pack 3, consider modifying the UserLogin control to prevent printing the password to standard output when an incorrect login attempt is made. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2005-1745

Affected Products

Bea Weblogic Portal

References · 7

• http://dev2dev.bea.com/pub/advisory/128 · Vendor Advisory
• http://secunia.com/advisories/15486 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-1745 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1745 · Note
• http://securityfocus.com/bid/13717 · Note
• http://securitytracker.com/id?1014049 · Note
• http://vupen.com/english/advisories/2005/0605 · Note