CVE-2006-0423

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-01-25 · updated 2026-06-16

Description

BEA WebLogic Portal 8.1 through SP3 stores the password for the RDBMS Authentication provider in cleartext in the config.xml file, which allows attackers to gain privileges.

Affected products

Oracle Weblogic Portal: 8.1, 8.1-sp1, 8.1-sp2, 8.1-sp3

References

http://dev2dev.bea.com/pub/advisory/167
http://dev2dev.bea.com/pub/advisory/262
http://secunia.com/advisories/18593
http://securitytracker.com/id?1015528
http://www.securityfocus.com/bid/16358
http://www.vupen.com/english/advisories/2006/0312
http://www.vupen.com/english/advisories/2008/0613
https://exchange.xforce.ibmcloud.com/vulnerabilities/24284
https://exchange.xforce.ibmcloud.com/vulnerabilities/40705
http://dev2dev.bea.com/pub/advisory/167
http://dev2dev.bea.com/pub/advisory/262
http://secunia.com/advisories/18593

Get alerted when CVE-2006-0423 or the next vulnerability affects your stack