Description
WebSphere Application Server 5.0.2 (or any earlier cumulative fix) stores admin and LDAP passwords in plaintext in the FFDC logs when a login to WebSphere fails, which allows attackers to gain privileges.
References
- PK17589 vendor-advisory
- http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg27006881
- 910 third-party-advisory
- ADV-2006-1736 vdb-entry
- 20032 third-party-advisory
- 20060509 IBM Websphere Application Server Multiple Vulnerabilities mailing-list