CVE-2006-0423

Published: Jan 25, 2006Modified: Apr 16, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

BEA WebLogic Portal 8.1 through SP3 stores the password for the RDBMS Authentication provider in cleartext in the config.xml file, which allows attackers to gain privileges.

Affected (4)

Products: Oracle: Weblogic Portal

Oracle

1 product

Weblogic Portal

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Oracle Weblogic Portal	Version 8.1
Oracle Weblogic Portal	Version 8.1 sp1
Oracle Weblogic Portal	Version 8.1 sp2
Oracle Weblogic Portal	Version 8.1 sp3

References (18)

http://dev2dev.bea.com/pub/advisory/167

Source: cve@mitre.org

PatchVendor Advisory

http://dev2dev.bea.com/pub/advisory/262

Source: cve@mitre.org

http://secunia.com/advisories/18593

Source: cve@mitre.org

http://securitytracker.com/id?1015528

Source: cve@mitre.org

Patch

http://www.securityfocus.com/bid/16358

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2006/0312

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/0613

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/24284

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/40705

Source: cve@mitre.org

http://dev2dev.bea.com/pub/advisory/167