Unscored severity · published Jul 18, 2005
CVE-2005-2292
Oracle JDeveloper 9.0.4, 9.0.5, and 10.1.2 stores cleartext passwords in (1) IDEConnections.xml, (2) XSQLConfig.xml and (3) settings.xml, which allows local users to obtain…
–
CVSS
0.9%
EPSS
No
On KEV
Description
Oracle JDeveloper 9.0.4, 9.0.5, and 10.1.2 stores cleartext passwords in (1) IDEConnections.xml, (2) XSQLConfig.xml and (3) settings.xml, which allows local users to obtain sensitive information.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JD
Jdeveloper · Oracle
9.0.4; 9.0.5; 10.1.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-2292
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-2292
marc.info
http://marc.info/?l=bugtraq&m=112129177927502&w=2
Patch
http://secunia.com/advisories/15991/
Patch
http://www.oracle.com/technology/deploy/security/pdf/cpujul2005.html
Vendor Advisory
http://www.red-database-security.com/advisory/oracle_jdeveloper_plaintext_password.html
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/21342
More from Jdeveloper
9.8
CVE-2022-21445
Oracle ADF Faces Deserialization of Untrusted Data Vulnerability
10.0
CVE-2018-14721
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class…
9.8
CVE-2022-23305
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout
9.8
CVE-2020-10683
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks
9.8
CVE-2018-14718
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic…