CVE-2006-2469 — Weblogic Server vulnerability

3 documents3 sources
Severity
7.5HIGHNVD
EPSS
0.7%
top 28.13%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
BEA Weblogic Server
Timeline
PublishedMay 19
Latest updateMay 1

Description

The HTTP handlers in BEA WebLogic Server 9.0, 8.1 up to SP5, 7.0 up to SP6, and 6.1 up to SP7 stores the username and password in cleartext in the WebLogic Server log when access to a web application or protected JWS fails, which allows attackers to gain privileges.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages1 packages

▶NVDbea/weblogic_server5 versions+4

Patches

Patch: dev2dev.bea.com ↗Patch: secunia.com ↗Patch: dev2dev.bea.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-8qm3-5x8f-7qqj: The HTTP handlers in BEA WebLogic Server 9↗2022-05-01
▶
CVEList
CVE-2006-2469: The HTTP handlers in BEA WebLogic Server 9↗2006-05-19
▶
CVE-2006-2469 — BEA Weblogic Server vulnerability | cvebase