Nessus Plugin #12043

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

BEA WebLogic Operator/Admin Password Disclosure Vulnerability

Family:

CGI abuses

Category:

infos

Copyright:

This script is Copyright (C) 2004 Astharot

Summary:

Checks the version of WebLogic

Version:

$Revision: 1.2 $

Cve_id:

-

Bugtraq_id:

9501

Xrefs:

-

Description:

The remote web server is running WebLogic.

BEA WebLogic Server and WebLogic Express are reported prone to a vulnerability
that may result in the disclosure of Operator or Admin passwords. An attacker
who has interactive access to the affected managed server, may potentially
exploit this issue in a timed attack to harvest credentials when the managed
server fails during the boot process.

Solution : http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_51.00.jsp
Risk factor : Low