CVE-2004-0712: Medium severity Bea WebLogic Server vulnerability
Published Jul 21, 2004
·Updated
The configuration tools (1) config.sh in Unix or (2) config.cmd in Windows for BEA WebLogic Server 8.1 through SP2 create a log file that contains the administrative username and password in cleartext, which could allow local users to gain privileges.
Affected Software
9 affected components
Bea WebLogic Server=8.1
Bea WebLogic Server=8.1
Bea WebLogic Server=8.1-sp1
Bea WebLogic Server=8.1
Bea WebLogic Server=8.1-sp1
Bea WebLogic Server=8.1-sp2
Bea WebLogic Server=8.1-sp1
Bea WebLogic Server=8.1-sp2
Bea WebLogic Server=8.1-sp2
Remediation
Patch Available
Patch Available
Event History
Jul 21, 2004
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-0712?
CVE-2004-0712 is classified as a medium severity vulnerability.
2
How do I fix CVE-2004-0712?
To fix CVE-2004-0712, ensure that the configuration scripts do not store sensitive information in cleartext log files.
3
Which versions of Oracle WebLogic Server are affected by CVE-2004-0712?
CVE-2004-0712 affects Oracle WebLogic Server versions 8.1, 8.1 SP1, and 8.1 SP2.
4
What type of sensitive information is exposed in CVE-2004-0712?
CVE-2004-0712 exposes administrative usernames and passwords in cleartext.
5
Who can exploit CVE-2004-0712?
Local users with access to the log files can exploit CVE-2004-0712 to gain administrative privileges.