Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
BEA WebLogic Server and WebLogic Express version 8.1 up to SP2, 7.0 up to SP4, and 6.1 up to SP6 may store the database username and password for an untargeted JDBC connection pool in plaintext in config.xml, which allows local users to gain privileges.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
BEA WebLogic Server和Express密码泄露漏洞
Vulnerability Description
BEA Systems WebLogic包含多种应用系统集成方案，包括Server/Express/Integration等。 BEA WebLogic Server和Express在部分配置环境下密码存储存在问题，本地攻击者可以利用这个漏洞获得敏感密码信息。 当服务器配置为采用非目标JDBC连接池并配置了数据库用户名和密码，WebLogic Server/Express就会把数据库密码信息以明文方式写入到配置文件中。攻击者获得这些密码后可以访问数据库。
CVSS Information
N/A
Vulnerability Type
N/A