BEA WebLogic config.xml Operator/Admin Password Disclosure

medium Nessus Plugin ID 12043

Language:

Synopsis

The remote web server is affected by a password disclosure vulnerability.

Description

The remote web server is running WebLogic. BEA WebLogic Server and WebLogic Express are reportedly may allow disclosure of Operator or Admin passwords. An attacker who has interactive access to the affected managed server may potentially exploit this issue in a timed attack to harvest credentials when the managed server fails during the boot process.

Solution

Apply vendor-supplied patches.

Plugin Details

Severity: Medium

ID: 12043

File Name: bea_password.nasl

Version: 1.20

Type: remote

Family: CGI abuses

Published: 2/5/2004

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.8

CVSS v2

Risk Factor: Medium

Base Score: 4.4

Temporal Score: 3.8

Vector: CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Information

Required KB Items: www/weblogic

Exploit Available: true

Exploit Ease: No exploit is required

Vulnerability Publication Date: 1/27/2004

Reference Information

CVE: CVE-2004-1757

BID: 9501

CERT: 350350

Detections

Analytics