|
|
Info |
Last Modified |
| 9 months ago |
|
|
|
|
Description |
BEA WebLogic Server and Express contain a flaw that may lead to an unauthorized password exposure. It is possible to gain access to plaintext passwords when a foreign Java Messaging Provider (JMS) is used, which may lead to a loss of confidentiality, integrity and/or availability.
|
|
Classification |
Attack Type:
Cryptographic,
Information Disclosure
|
|
Technical |
A remote authenticated or local attacker can access the console or open the config.xml file to obtain the plaintext password to the JMS provider.
|
|
Solution |
Currently, there are no known workarounds or upgrades to correct this issue. However, BEA has released a patch to address this vulnerability. Please refer to the original vendor advisory for further information.
|
|
Products |
|
WebLogic Server
 |
6.1 |
7.0 |
8.1 |
WebLogic Express
|
6.1 |
7.0 |
8.1 |
|
|
|
|
Credit |
Unknown or Incomplete
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
