Unscored severity · published Oct 18, 2007
CVE-2007-5576
BEA Tuxedo 8.0 before RP392 and 8.1 before RP293, and WebLogic Enterprise 5.1 before RP174, echo the password in cleartext, which allows physically proximate attackers to obtain…
–
CVSS
1%
EPSS
No
On KEV
Description
BEA Tuxedo 8.0 before RP392 and 8.1 before RP293, and WebLogic Enterprise 5.1 before RP174, echo the password in cleartext, which allows physically proximate attackers to obtain sensitive information via the (1) cnsbind, (2) cnsunbind, or (3) cnsls commands.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TU
Tuxedo · Bea
8.0; 8.1 · source: NVD
WI
Weblogic Integration · Bea
8.1; 8.1; 8.1; 8.1; 8.1; 8.1; +1 more · source: NVD
WP
Weblogic Portal · Oracle
9.2 · source: NVD
WS
Weblogic Server · Bea
5.1; 6.1; 6.1; 6.1; 6.1; 6.1; +34 more · source: NVD
WW
Weblogic Workshop · Bea
8.1; 8.1; 8.1; 8.1; 8.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-5576
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-5576
dev2dev.bea.com
http://dev2dev.bea.com/pub/advisory/226
osvdb.org
http://osvdb.org/45478
www.vupen.com
http://www.vupen.com/english/advisories/2007/1813
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/34290
More from Tuxedo
–
CVE-2003-0621
The Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to determine the existence of files outside the web root via modified paths in the INIFILE…
–
CVE-2003-0622
The Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to cause a denial of service (hang) via pathname arguments that contain MS-DOS device names such…
–
CVE-2003-0623
Cross-site scripting (XSS) vulnerability in the Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to inject arbitrary web script via the INIFILE…
–
CVE-2001-1477
The Domain gateway in BEA Tuxedo 7.1 does not perform authorization checks for imported services and qspaces on remote domains, even when an ACL exists, which allows users to…