CVE-2005-2292

Oracle JDeveloper 9.0.4, 9.0.5, and 10.1.2 stores cleartext passwords in (1) IDEConnections.xml, (2) XSQLConfig.xml and (3) settings.xml, which allows local users to obtain sensitive information.

CVSS v2.0 2.1 LOW

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://marc.info/?l=bugtraq&m=112129177927502&w=2
http://secunia.com/advisories/15991/	Patch Vendor Advisory
http://www.oracle.com/technology/deploy/security/pdf/cpujul2005.html	Patch Vendor Advisory
http://www.red-database-security.com/advisory/oracle_jdeveloper_plaintext_password.html	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/21342
http://marc.info/?l=bugtraq&m=112129177927502&w=2
http://secunia.com/advisories/15991/	Patch Vendor Advisory
http://www.oracle.com/technology/deploy/security/pdf/cpujul2005.html	Patch Vendor Advisory
http://www.red-database-security.com/advisory/oracle_jdeveloper_plaintext_password.html	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/21342

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:oracle:jdeveloper:9.0.4:::::::*
	cpe:2.3:a:oracle:jdeveloper:9.0.5:::::::*
	cpe:2.3:a:oracle:jdeveloper:10.1.2:::::::*

History

No history.

Information

Published : 2005-07-18 04:00

Updated : 2025-04-03 01:03

NVD link : CVE-2005-2292

Mitre link : CVE-2005-2292

CVE.ORG link : CVE-2005-2292

JSON object : View

Products Affected

oracle

jdeveloper

CWE

NVD-CWE-Other

{"id": "CVE-2005-2292", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2005-07-18T04:00:00.000", "references": [{"url": "http://marc.info/?l=bugtraq&m=112129177927502&w=2", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/15991/", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.oracle.com/technology/deploy/security/pdf/cpujul2005.html", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.red-database-security.com/advisory/oracle_jdeveloper_plaintext_password.html", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/21342", "source": "cve@mitre.org"}, {"url": "http://marc.info/?l=bugtraq&m=112129177927502&w=2", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/15991/", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.oracle.com/technology/deploy/security/pdf/cpujul2005.html", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.red-database-security.com/advisory/oracle_jdeveloper_plaintext_password.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/21342", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Oracle JDeveloper 9.0.4, 9.0.5, and 10.1.2 stores cleartext passwords in (1) IDEConnections.xml, (2) XSQLConfig.xml and (3) settings.xml, which allows local users to obtain sensitive information."}, {"lang": "es", "value": "Oracle JDeveloper 9.0.4, 9.0.5, y 10.1.2 almacena passwords como texto plano en 1) IDEConnections.xml, (2) XSQLConfig.xml y (3) settings.xml. Esto permite que usuarios locales obtengan informaci\u00f3n confidencial."}], "lastModified": "2025-04-03T01:03:51.193", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:jdeveloper:9.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E292E294-90C2-4780-82B6-1265F8FF6040"}, {"criteria": "cpe:2.3:a:oracle:jdeveloper:9.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A5EA5B15-5ABD-459D-8327-9DDC1040C04D"}, {"criteria": "cpe:2.3:a:oracle:jdeveloper:10.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A4C7F9B0-2BF0-430D-ACB3-8E3A41AD31A3"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}