Lucene search
HistoryJan 25, 2006 - 11:07 p.m.
CVE-2006-0426
cve-2006-0426
bea weblogic server
weblogic express 8.1
configuration auditing
password change
cleartext
defaultauditrecorder.log
privilege escalation
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
7 High
AI Score
Confidence
High
0.005 Low
EPSS
Percentile
77.5%
BEA WebLogic Server and WebLogic Express 8.1 through SP4, when configuration auditing is enabled and a password change occurs, stores the old and new passwords in cleartext in the DefaultAuditRecorder.log file, which could allow attackers to gain privileges.
Affected configurations
Node
beaweblogic_serverMatch8.1sp1
ORbeaweblogic_serverMatch8.1sp1express
ORbeaweblogic_serverMatch8.1sp2
ORbeaweblogic_serverMatch8.1sp2express
ORbeaweblogic_serverMatch8.1sp3
ORbeaweblogic_serverMatch8.1sp3express
ORbeaweblogic_serverMatch8.1sp4
ORbeaweblogic_serverMatch8.1sp4express
| CPE | Name | Operator | Version |
|---|---|---|---|
| bea:weblogic_server | bea weblogic server | eq | 8.1 |
Related
nvd
nvd
CVE-2006-0426
2006-01-25 23:07:00
prion
prion
Code injection
2006-01-25 23:07:00
cvelist
cvelist
CVE-2006-0426
2006-01-25 23:00:00
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
7 High
AI Score
Confidence
High
0.005 Low
EPSS
Percentile
77.5%
Related for CVE-2006-0426