CVE-2007-2700

BEA WebLogic <9.2 - Info Disclosure

Title source: llm

Description

The WLST script generated by the configToScript command in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not encrypt certain attributes in configuration files when creating a new domain, which allows remote authenticated users to obtain sensitive information.

References (6)

[Vendor Advisory] http://secunia.com/advisories/25284

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/34288

[Vendor Advisory] http://dev2dev.bea.com/pub/advisory/233

[Third Party Advisory, VDB Entry] http://osvdb.org/36068

[Third Party Advisory, VDB Entry] http://securitytracker.com/id?1018057

[Third Party Advisory] http://www.vupen.com/english/advisories/2007/1815

Scores

EPSS 0.0034

EPSS Percentile 56.3%

Classification

Status draft

Affected Products (4)

bea/weblogic_server

Timeline

Published May 16, 2007

Tracked Since Feb 18, 2026