CVE-2007-5576 BEA Tuxedo 8.0 before RP392 and 8.1 before RP293, and WebLogic Enterprise 5.1 before RP174, echo the password in cleartext, which allows physically proximate attackers to obtain sensitive information....
MediumCVSS 6.8
EPSS 1.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
BEA Tuxedo 8.0 before RP392 and 8.1 before RP293, and WebLogic Enterprise 5.1 before RP174, echo the password in cleartext, which allows physically proximate attackers to obtain sensitive information via the (1) cnsbind, (2) cnsunbind, or (3) cnsls commands.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bea tuxedo | = 8.0 | No fix listed |
| bea tuxedo | = 8.1 | No fix listed |
| bea weblogic integration | = 8.1 | No fix listed |
| bea weblogic integration | = 8.1-sp2 | No fix listed |
| bea weblogic integration | = 8.1-sp3 | No fix listed |
| bea weblogic integration | = 8.1-sp4 | No fix listed |
| bea weblogic integration | = 8.1-sp5 | No fix listed |
| bea weblogic integration | = 8.1-sp6 | No fix listed |
| bea weblogic integration | = 9.2 | No fix listed |
| bea weblogic server | = 5.1 | No fix listed |
| bea weblogic server | = 6.1 | No fix listed |
| bea weblogic server | = 6.1-sp1 | No fix listed |
| bea weblogic server | = 6.1-sp2 | No fix listed |
| bea weblogic server | = 6.1-sp3 | No fix listed |
| bea weblogic server | = 6.1-sp4 | No fix listed |
| bea weblogic server | = 6.1-sp5 | No fix listed |
| bea weblogic server | = 6.1-sp6 | No fix listed |
| bea weblogic server | = 6.1-sp7 | No fix listed |
| bea weblogic server | = 7.0 | No fix listed |
| bea weblogic server | = 7.0-sp1 | No fix listed |
| bea weblogic server | = 7.0-sp2 | No fix listed |
| bea weblogic server | = 7.0-sp3 | No fix listed |
| bea weblogic server | = 7.0-sp4 | No fix listed |
| bea weblogic server | = 7.0-sp5 | No fix listed |
| bea weblogic server | = 7.0-sp6 | No fix listed |
Show 21 more
| Product | Affected versions | Fixed in |
|---|---|---|
| bea weblogic server | = 7.0-sp7 | No fix listed |
| bea weblogic server | = 7.0.0.1 | No fix listed |
| bea weblogic server | = 7.0.0.1-sp1 | No fix listed |
| bea weblogic server | = 7.0.0.1-sp2 | No fix listed |
| bea weblogic server | = 7.0.0.1-sp3 | No fix listed |
| bea weblogic server | = 7.0.0.1-sp4 | No fix listed |
| bea weblogic server | = 8.1 | No fix listed |
| bea weblogic server | = 8.1-sp1 | No fix listed |
| bea weblogic server | = 8.1-sp2 | No fix listed |
| bea weblogic server | = 8.1-sp3 | No fix listed |
| bea weblogic server | = 8.1-sp4 | No fix listed |
| bea weblogic server | = 8.1-sp5 | No fix listed |
| bea weblogic server | = 9.0 | No fix listed |
| bea weblogic server | = 9.1 | No fix listed |
| bea weblogic server | = 9.2 | No fix listed |
| bea weblogic workshop | = 8.1-sp2 | No fix listed |
| bea weblogic workshop | = 8.1-sp3 | No fix listed |
| bea weblogic workshop | = 8.1-sp4 | No fix listed |
| bea weblogic workshop | = 8.1-sp5 | No fix listed |
| bea weblogic workshop | = 8.1-sp6 | No fix listed |
| oracle weblogic portal | = 9.2 | No fix listed |
References
- BEA07-158.00 vendor-advisory
- 45478 vdb-entry
- ADV-2007-1813 vdb-entry
- weblogic-tuxedo-information-disclosure(34290) vdb-entry