CVE-2007-0409

BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP4, and 9.0 initial release does not encrypt passwords stored in the JDBCDataSourceFactory MBean Properties, which allows local administrative users to read the cleartext password.

Link	Resource
http://dev2dev.bea.com/pub/advisory/203	Patch Vendor Advisory
http://securitytracker.com/id?1017525
http://secunia.com/advisories/23750
http://www.securityfocus.com/bid/22082
http://osvdb.org/38501
http://www.vupen.com/english/advisories/2007/0213

Configuration 1

cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:*:sp4:*:*:*:*:*:* cpe:2.3:a:bea:weblogic_server:*:sp6:*:*:*:*:*:*

---

Published : 2007-01-23 12:28

Updated : 2011-03-08 02:49

---

NVD link : CVE-2007-0409

Mitre link : CVE-2007-0409

No products.

NVD-CWE-Other