First published: Sat Dec 31 2005(Updated: )
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier sometimes stores the boot password in the registry in cleartext, which might allow local users to gain administrative privileges.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
Oracle WebLogic Server | =6.1 | |
Oracle WebLogic Server | =6.1 | |
Oracle WebLogic Server | =6.1 | |
Oracle WebLogic Server | =6.1-sp1 | |
Oracle WebLogic Server | =6.1-sp1 | |
Oracle WebLogic Server | =6.1-sp1 | |
Oracle WebLogic Server | =6.1-sp2 | |
Oracle WebLogic Server | =6.1-sp2 | |
Oracle WebLogic Server | =6.1-sp2 | |
Oracle WebLogic Server | =6.1-sp3 | |
Oracle WebLogic Server | =6.1-sp3 | |
Oracle WebLogic Server | =6.1-sp3 | |
Oracle WebLogic Server | =6.1-sp4 | |
Oracle WebLogic Server | =6.1-sp4 | |
Oracle WebLogic Server | =6.1-sp4 | |
Oracle WebLogic Server | =6.1-sp5 | |
Oracle WebLogic Server | =6.1-sp5 | |
Oracle WebLogic Server | =6.1-sp5 | |
Oracle WebLogic Server | =6.1-sp6 | |
Oracle WebLogic Server | =6.1-sp7 | |
Oracle WebLogic Server | =6.1-sp7 | |
Oracle WebLogic Server | =6.1-sp7 | |
Oracle WebLogic Server | =7.0 | |
Oracle WebLogic Server | =7.0 | |
Oracle WebLogic Server | =7.0 | |
Oracle WebLogic Server | =7.0-sp1 | |
Oracle WebLogic Server | =7.0-sp1 | |
Oracle WebLogic Server | =7.0-sp1 | |
Oracle WebLogic Server | =7.0-sp2 | |
Oracle WebLogic Server | =7.0-sp2 | |
Oracle WebLogic Server | =7.0-sp2 | |
Oracle WebLogic Server | =7.0-sp3 | |
Oracle WebLogic Server | =7.0-sp3 | |
Oracle WebLogic Server | =7.0-sp3 | |
Oracle WebLogic Server | =7.0-sp4 | |
Oracle WebLogic Server | =7.0-sp4 | |
Oracle WebLogic Server | =7.0-sp4 | |
Oracle WebLogic Server | =7.0-sp5 | |
Oracle WebLogic Server | =7.0-sp5 | |
Oracle WebLogic Server | =7.0-sp5 | |
Oracle WebLogic Server | =7.0-sp6 | |
Oracle WebLogic Server | =7.0-sp6 | |
Oracle WebLogic Server | =7.0-sp6 | |
Oracle WebLogic Server | =8.1 | |
Oracle WebLogic Server | =8.1 | |
Oracle WebLogic Server | =8.1 | |
Oracle WebLogic Server | =8.1-sp1 | |
Oracle WebLogic Server | =8.1-sp1 | |
Oracle WebLogic Server | =8.1-sp1 | |
Oracle WebLogic Server | =8.1-sp2 | |
Oracle WebLogic Server | =8.1-sp2 | |
Oracle WebLogic Server | =8.1-sp2 | |
Oracle WebLogic Server | =8.1-sp3 | |
Oracle WebLogic Server | =8.1-sp3 | |
Oracle WebLogic Server | =8.1-sp3 | |
Oracle WebLogic Server | =8.1-sp4 | |
Oracle WebLogic Server | =8.1-sp4 | |
Oracle WebLogic Server | =8.1-sp4 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2005-4762 has a high severity rating due to the exposure of sensitive information allowing local users to gain administrative privileges.
To fix CVE-2005-4762, ensure that you upgrade to a version of WebLogic Server later than 8.1 SP4 or apply specific workarounds provided by Oracle.
CVE-2005-4762 affects BEA WebLogic Server versions 6.1 SP7 and earlier, 7.0 SP6 and earlier, and 8.1 SP4 and earlier.
CVE-2005-4762 involves storing the boot password in the Windows registry in cleartext, risking unauthorized access by local users.
Organizations using affected versions of BEA WebLogic Server or WebLogic Express are at risk of exploitation by local adversaries.