Description
BEA WebLogic Portal 8.1 through SP3 stores the password for the RDBMS Authentication provider in cleartext in the config.xml file, which allows attackers to gain privileges.
References
- ADV-2008-0613 vdb-entry
- weblogic-portal-config-info-disclosure(40705) vdb-entry
- 18593 third-party-advisory
- BEA06-110.00 vendor-advisory
- ADV-2006-0312 vdb-entry
- 1015528 vdb-entry
- weblogicportal-config-info-disclosure(24284) vdb-entry
- 16358 vdb-entry
- BEA08-110.01 vendor-advisory