Description
The WLST script generated by the configToScript command in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not encrypt certain attributes in configuration files when creating a new domain, which allows remote authenticated users to obtain sensitive information.
References
- BEA07-163.00 vendor-advisory
- 1018057 vdb-entry
- 25284 third-party-advisory
- weblogic-configtoscr-information-disclosure(34288) vdb-entry
- 36068 vdb-entry
- ADV-2007-1815 vdb-entry