CVE-2007-0409

Published: Jan 23, 2007Modified: Apr 23, 2026

1.5

Vector

AV:L/AC:M/Au:S/C:P/I:N/A:N

Exploitability: 2.7 / Impact: 2.9

Source: NVD

Description

BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP4, and 9.0 initial release does not encrypt passwords stored in the JDBCDataSourceFactory MBean Properties, which allows local administrative users to read the cleartext password.

Affected (5)

Products: Bea: Weblogic Server

Bea

1 product

Weblogic Server

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Bea Weblogic Server	Up to 8.1
Bea Weblogic Server	Up to 7.0
Bea Weblogic Server	Version 7.0
Bea Weblogic Server	Version 8.1
Bea Weblogic Server	Version 9.0

References (12)

http://dev2dev.bea.com/pub/advisory/203

Source: cve@mitre.org

PatchVendor Advisory

http://osvdb.org/38501

Source: cve@mitre.org

http://secunia.com/advisories/23750

Source: cve@mitre.org

http://securitytracker.com/id?1017525

Source: cve@mitre.org

http://www.securityfocus.com/bid/22082

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2007/0213

Source: cve@mitre.org

http://dev2dev.bea.com/pub/advisory/203