Unscored CVE-2007-0409 EUVD-2007-0409GHSA-57cv-vqcj-8px9

BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP4, and 9.0 initial release does not encrypt passwords stored in the JDBCDataSourceFacto…

Published Jan 23, 2007 · Updated Aug 7, 2024 · Assigned by mitre

Description

BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP4, and 9.0 initial release does not encrypt passwords stored in the JDBCDataSourceFactory MBean Properties, which allows local administrative users to read the cleartext password.

References

BEA07-136.00 vendor-advisory
1017525 vdb-entry
23750 third-party-advisory
22082 vdb-entry
38501 vdb-entry
ADV-2007-0213 vdb-entry