CVE-2007-0409

BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP4, and 9.0 initial release does not encrypt passwords stored in the JDBCDataSourceFactory MBean Properties, which allows local administrative users to read the cleartext password.

Published: Jan 23, 2007
Updated: Apr 13, 2023
CVE: CVE-2007-0409
Severity: Low
Exploit:

CVSS v2:

Severity: Low
Score: 1.5
AV:L/AC:M/Au:S/C:P/I:N/A:N

No CWE or OWASP classifications available.

Affected Software
References

Software	From	Fixed in
bea / weblogic_server	8.1	8.1.x
bea / weblogic_server	9.0	9.0.x
bea / weblogic_server	7.0	7.0.x
bea / weblogic_server	-	8.1.x
bea / weblogic_server	-	7.0.x

http://dev2dev.bea.com/pub/advisory/203
http://osvdb.org/38501
http://secunia.com/advisories/23750
http://securitytracker.com/id?1017525
http://www.securityfocus.com/bid/22082
http://www.vupen.com/english/advisories/2007/0213

Vulnerability Database

289,599

CVE-2007-0409