CVE-2006-2468: Medium severity Bea WebLogic Server vulnerability
Published May 19, 2006
·Updated
The WebLogic Server Administration Console in BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6 displays the domain name in the Console login form, which allows remote attackers to obtain sensitive information.
Affected Software
10 affected components
Bea WebLogic Server=8.1
Bea WebLogic Server=7.0-sp4
Bea WebLogic Server=7.0
Bea WebLogic Server=7.0-sp3
Bea WebLogic Server=8.1-sp3
Bea WebLogic Server=7.0-sp2
Bea WebLogic Server=7.0-sp5
Bea WebLogic Server=8.1-sp2
Bea WebLogic Server=7.0-sp1
Bea WebLogic Server=8.1-sp1
Remediation
Patch Available
Patch Available
Event History
May 19, 2006
CVE Published
10:02 AM
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2006-2468?
CVE-2006-2468 is classified as a medium severity vulnerability.
2
How do I fix CVE-2006-2468?
To fix CVE-2006-2468, update to a patched version of BEA WebLogic Server or disable the display of the domain name in the login form.
3
Which versions of WebLogic Server are affected by CVE-2006-2468?
CVE-2006-2468 affects BEA WebLogic Server versions 7.0 up to SP6 and 8.1 up to SP4.
4
What is the technical impact of CVE-2006-2468?
CVE-2006-2468 allows remote attackers to gain sensitive information by observing the domain name in the login form.
5
Can CVE-2006-2468 be exploited remotely?
Yes, CVE-2006-2468 can be exploited remotely by attackers with network access to the WebLogic Server Administration Console.