CVE-2005-2292: Low severity Oracle JDeveloper vulnerability
Published Jul 17, 2005
·Updated
Oracle JDeveloper 9.0.4, 9.0.5, and 10.1.2 stores cleartext passwords in (1) IDEConnections.xml, (2) XSQLConfig.xml and (3) settings.xml, which allows local users to obtain sensitive information.
Affected Software
3 affected components
Oracle JDeveloper=9.0.4
Oracle JDeveloper=9.0.5
Oracle JDeveloper=10.1.2
Remediation
Patch Available
Event History
Jul 17, 2005
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2005-2292?
CVE-2005-2292 is considered a high severity vulnerability due to the exposure of cleartext passwords.
2
How do I fix CVE-2005-2292?
To fix CVE-2005-2292, you should upgrade to a version of Oracle JDeveloper that does not store passwords in cleartext.
3
Which versions of Oracle JDeveloper are affected by CVE-2005-2292?
CVE-2005-2292 affects Oracle JDeveloper versions 9.0.4, 9.0.5, and 10.1.2.
4
What information is exposed in CVE-2005-2292?
CVE-2005-2292 exposes sensitive information such as usernames and passwords stored in cleartext.
5
Can local users exploit CVE-2005-2292?
Yes, local users can exploit CVE-2005-2292 to obtain sensitive information from the configuration files.