CVE-2007-0409: Bea WebLogic Server

Low severity, CVSS 1.5. EPSS: 0.3% chance of exploitation in the next 30 days.

BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP4, and 9.0 initial release does not encrypt passwords stored in the JDBCDataSourceFactory MBean Properties, which allows local administrative users to read the cleartext password.

Affected products

• Bea WebLogic Server: up to and including 7.0; up to and including 8.1; version 7.0 only; version 8.1 only; version 9.0 only

Published 2007-01-23. Last modified 2026-06-16.