CVE-2007-5576

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-10-18 · updated 2026-06-16
Weakness: CWE-200

Description

BEA Tuxedo 8.0 before RP392 and 8.1 before RP293, and WebLogic Enterprise 5.1 before RP174, echo the password in cleartext, which allows physically proximate attackers to obtain sensitive information via the (1) cnsbind, (2) cnsunbind, or (3) cnsls commands.

Affected products

Bea Tuxedo: 8.0, 8.1
Bea Weblogic Integration: 8.1, 8.1-sp2, 8.1-sp3, 8.1-sp4, 8.1-sp5, 8.1-sp6 (+1)
Bea Weblogic Server: 5.1, 6.1, 6.1-sp1, 6.1-sp2, 6.1-sp3, 6.1-sp4 (+25)
Bea Weblogic Workshop: 8.1-sp2, 8.1-sp3, 8.1-sp4, 8.1-sp5, 8.1-sp6
Oracle Weblogic Portal: 9.2

References

http://dev2dev.bea.com/pub/advisory/226
http://osvdb.org/45478
http://www.vupen.com/english/advisories/2007/1813
https://exchange.xforce.ibmcloud.com/vulnerabilities/34290
http://dev2dev.bea.com/pub/advisory/226
http://osvdb.org/45478
http://www.vupen.com/english/advisories/2007/1813
https://exchange.xforce.ibmcloud.com/vulnerabilities/34290

Get alerted when CVE-2007-5576 or the next vulnerability affects your stack