| Vulnerability Name: | CVE-2005-4755 (CCN-22573) | ||||||||
| Assigned: | 2005-10-12 | ||||||||
| Published: | 2005-10-12 | ||||||||
| Updated: | 2018-09-27 | ||||||||
| Summary: | BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier (1) stores the private key passphrase (CustomTrustKeyStorePassPhrase) in cleartext in nodemanager.config; or, during domain creation with the Configuration Wizard, renders an SSL private key passphrase in cleartext (2) on a terminal or (3) in a log file, which might allow local users to obtain cryptographic keys. | ||||||||
| CVSS v3 Severity: | 4.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
| ||||||||
| CVSS v2 Severity: | 2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)
| ||||||||
| Vulnerability Type: | CWE-Other | ||||||||
| Vulnerability Consequences: | Obtain Information | ||||||||
| References: | Source: MITRE Type: CNA CVE-2005-4755 Source: BEA Type: Patch, Vendor Advisory BEA05-91.00 Source: BEA Type: Patch, Vendor Advisory BEA05-96.00 Source: CCN Type: BEA Systems Inc. Web site BEA Product Documentation Source: CCN Type: SA17138 BEA WebLogic 24 Vulnerabilities and Security Issues Source: SECUNIA Type: Third Party Advisory 17138 Source: BID Type: Third Party Advisory, VDB Entry 15052 Source: CCN Type: BID-15052 BEA WebLogic Server and WebLogic Express Multiple Vulnerabilities Source: XF Type: UNKNOWN weblogic-passphrase-information-disclosure(22573) Source: CCN Type: BEA Systems Security Advisory: (BEA05-91.00) The passphrase for the Trust keystore appears in clear text in the nodemanager.config file. | ||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||
| Vulnerability Name: | CVE-2005-4755 (CCN-22582) | ||||||||
| Assigned: | 2005-10-12 | ||||||||
| Published: | 2005-10-12 | ||||||||
| Updated: | 2005-10-12 | ||||||||
| Summary: | BEA WebLogic Server and Express could allow a remote attacker to obtain sensitive information caused by a vulnerability when creating a new domain using the Configuration Wizard. The passphrase for the private key that is used within the configuration of Secure Socket Layer (SSL) is echoed to the screen including the server log file. A remote attacker with file system access to the keystore could exploit this vulnerability by using the Configuration Wizard when creating a WebLogic server to obtain sensitive information, such as viewing the passphrase in plain text or possibly obtaining the SSL keystore passphrase. | ||||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
| ||||||||
| CVSS v2 Severity: | 2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)
| ||||||||
| Vulnerability Consequences: | Obtain Information | ||||||||
| References: | Source: MITRE Type: CNA CVE-2005-4755 Source: CCN Type: BEA Systems Inc. Web site BEA Product Documentation Source: CCN Type: SA17138 BEA WebLogic 24 Vulnerabilities and Security Issues Source: CCN Type: BID-15052 BEA WebLogic Server and WebLogic Express Multiple Vulnerabilities Source: XF Type: UNKNOWN weblogic-configuration-obtain-information(22582) Source: CCN Type: BEA Systems Security Advisory: (BEA05-96.00) The passphrase for the private key used in the configuration of SSL appears in cleartext when | ||||||||
| Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||||
| BACK | |||||||||