CVE-2006-0423: High severity Oracle Weblogic Portal vulnerability
Published Jan 25, 2006
·Updated
BEA WebLogic Portal 8.1 through SP3 stores the password for the RDBMS Authentication provider in cleartext in the config.xml file, which allows attackers to gain privileges.
Affected Software
4 affected components
Oracle Weblogic Portal=8.1
Oracle Weblogic Portal=8.1-sp1
Oracle Weblogic Portal=8.1-sp2
Oracle Weblogic Portal=8.1-sp3
Remediation
Patch Available
Patch Available
Event History
Jan 25, 2006
CVE Published
11:07 PM
Jan 26, 2006
CVE Published
via MITRE·04:00 AM
Data Sourced
via MITRE·04:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2006-0423?
CVE-2006-0423 is considered a high severity vulnerability due to the storage of passwords in cleartext.
2
How do I fix CVE-2006-0423?
To fix CVE-2006-0423, ensure that passwords are stored securely and inaccessible in the configuration files.
3
What versions of BEA WebLogic Portal are affected by CVE-2006-0423?
CVE-2006-0423 affects BEA WebLogic Portal 8.1 through SP3 versions.
4
What are the potential risks of exploiting CVE-2006-0423?
Exploiting CVE-2006-0423 allows attackers to gain unauthorized access and privileges to the database through cleartext credentials.
5
Is there a patch available for CVE-2006-0423?
There are no specific patches for CVE-2006-0423; it is recommended to upgrade to a more secure version.