Overview
WebLogic Server contains a vulnerability that may expose the database username and password in clear text in the config.xml file.
Description
BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure for developing, integrating, securing, and managing distributed Java applications." There is a vulnerability in the WebLogic Server that may expose the database username and password for untargeted JDBC connection pools. Under certain circumstances, the database username and password may be stored in clear text within the config.xml file. According to the BEA Security Advisory, this vulnerability occurs under the following circumstances:
The BEA Security Advisory states that the following versions of WebLogic Server and Express are affected by this vulnerability:
|
Impact
A user with access to the config.xml file may acquire the database username and password. The user could subsequently use this password to access the database. |
Solution
UpgradeBEA has released an advisory to address this issue. According to the BEA Security Advisory, it is recommended that users take the following action: |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
- http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_53.00.jsp
- http://secunia.com/advisories/11357/
- http://securitytracker.com/alerts/2004/Apr/1009764.html
- http://edocs.bea.com/wls/docs61/adminguide/jdbc.html#1097203
- http://edocs.bea.com/wls/docs61/jdbc/programming.html#programming001
Acknowledgements
This vulnerability was reported by BEA Systems Inc.
This document was written by Damon Morda.
Other Information
| CVE IDs: | None |
| Severity Metric: | 5.94 |
| Date Public: | 2004-04-14 |
| Date First Published: | 2004-04-19 |
| Date Last Updated: | 2004-04-19 16:03 UTC |
| Document Revision: | 14 |