PT-2007-1884 · Bea · Bea Weblogic Server

Published 2007-01-23 · Updated 2011-03-08 · CVE-2007-0413

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Medium

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server versions 8.1 through 8.1 SP5

Description The issue allows local users to obtain sensitive information by reading a backup file of config.xml that contains cleartext data after offline editing.

Recommendations For BEA WebLogic Server versions 8.1 through 8.1 SP5, consider removing or securing the backup file of config.xml after offline editing to prevent unauthorized access to sensitive information.

Fix

Related Identifiers

CVE-2007-0413

Affected Products

Bea Weblogic Server

References · 8

• http://secunia.com/advisories/23750 · Vendor Advisory
• http://dev2dev.bea.com/pub/advisory/207 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-0413 · Security Note
• http://osvdb.org/38504 · Note
• http://vupen.com/english/advisories/2007/0213 · Note
• http://securityfocus.com/bid/22082 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0413 · Note
• http://securitytracker.com/id?1017525 · Note