Description
BEA WebLogic Server and Express 8.1, SP1 and earlier, stores the administrator password in cleartext in config.xml, which allows local users to gain privileges.
References
- 10728 third-party-advisory
- VU#350350 third-party-advisory
- weblogic-boot-password-disclosure(14957) vdb-entry
- 9501 vdb-entry
- http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_50.00.jsp