PT-2007-1880 · Bea · Bea Weblogic

Published 2007-01-23 · Updated 2011-03-08 · CVE-2007-0409

Positive Technologies (AI Summary)

CVSS v2.0

1.5

Low

Base vector

AV:L/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic versions 7.0 through 7.0 SP6 BEA WebLogic versions 8.1 through 8.1 SP4 BEA WebLogic version 9.0 initial release

Description The issue allows local administrative users to read cleartext passwords stored in the JDBCDataSourceFactory MBean Properties due to a lack of encryption.

Recommendations For BEA WebLogic versions 7.0 through 7.0 SP6, consider restricting access to the JDBCDataSourceFactory MBean Properties to minimize the risk of exploitation. For BEA WebLogic versions 8.1 through 8.1 SP4, consider restricting access to the JDBCDataSourceFactory MBean Properties to minimize the risk of exploitation. For BEA WebLogic version 9.0 initial release, consider restricting access to the JDBCDataSourceFactory MBean Properties to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-0409

Affected Products

Bea Weblogic

References · 8

• http://dev2dev.bea.com/pub/advisory/203 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-0409 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0409 · Note
• http://secunia.com/advisories/23750 · Note
• http://vupen.com/english/advisories/2007/0213 · Note
• http://securityfocus.com/bid/22082 · Note
• http://osvdb.org/38501 · Note
• http://securitytracker.com/id?1017525 · Note