CVE-2006-2469
First published: Fri May 19 2006(Updated: )
The HTTP handlers in BEA WebLogic Server 9.0, 8.1 up to SP5, 7.0 up to SP6, and 6.1 up to SP7 stores the username and password in cleartext in the WebLogic Server log when access to a web application or protected JWS fails, which allows attackers to gain privileges.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle WebLogic Server | =6.1-sp4 | |
| Oracle WebLogic Server | =8.1 | |
| Oracle WebLogic Server | =6.1-sp5 | |
| Oracle WebLogic Server | =9.0 | |
| Oracle WebLogic Server | =7.0-sp4 | |
| Oracle WebLogic Server | =7.0 | |
| Oracle WebLogic Server | =6.1-sp3 | |
| Oracle WebLogic Server | =7.0-sp3 | |
| Oracle WebLogic Server | =8.1-sp3 | |
| Oracle WebLogic Server | =7.0-sp2 | |
| Oracle WebLogic Server | =7.0-sp5 | |
| Oracle WebLogic Server | =6.1-sp1 | |
| Oracle WebLogic Server | =6.0-sp6 | |
| Oracle WebLogic Server | =8.1-sp2 | |
| Oracle WebLogic Server | =6.1 | |
| Oracle WebLogic Server | =7.0-sp1 | |
| Oracle WebLogic Server | =8.1-sp1 | |
| Oracle WebLogic Server | =8.1-sp4 | |
| Oracle WebLogic Server | =6.1-sp2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2006-2469?
CVE-2006-2469 has a medium severity rating due to the potential exposure of sensitive information.
How do I fix CVE-2006-2469?
To address CVE-2006-2469, ensure that you upgrade to the latest patched version of the affected WebLogic Server software.
What versions of Oracle WebLogic Server are affected by CVE-2006-2469?
CVE-2006-2469 affects Oracle WebLogic Server versions 6.1 (up to SP7), 7.0 (up to SP6), 8.1 (up to SP5), and 9.0.
What types of data are compromised in CVE-2006-2469?
CVE-2006-2469 can result in the leakage of usernames and passwords stored in cleartext in server logs.
What are the potential risks of exploiting CVE-2006-2469?
Exploiting CVE-2006-2469 can allow attackers to gain unauthorized access and privileges over the affected web applications.
- agent/type
- agent/softwarecombine
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/weakness
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/bea
- canonical/oracle weblogic server
- version/oracle weblogic server/6.1-sp4
- version/oracle weblogic server/8.1
- version/oracle weblogic server/6.1-sp5
- version/oracle weblogic server/9.0
- version/oracle weblogic server/7.0-sp4
- version/oracle weblogic server/7.0
- version/oracle weblogic server/6.1-sp3
- version/oracle weblogic server/7.0-sp3
- version/oracle weblogic server/8.1-sp3
- version/oracle weblogic server/7.0-sp2
- version/oracle weblogic server/7.0-sp5
- version/oracle weblogic server/6.1-sp1
- version/oracle weblogic server/6.0-sp6
- version/oracle weblogic server/8.1-sp2
- version/oracle weblogic server/6.1
- version/oracle weblogic server/7.0-sp1
- version/oracle weblogic server/8.1-sp1
- version/oracle weblogic server/8.1-sp4
- version/oracle weblogic server/6.1-sp2