PT-2002-2858 · Bea · Bea Weblogic Express+1

Publicado 2002-12-31 · Atualizado 2008-09-10 · CVE-2002-2141

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: BEA WebLogic Server and Express versions 7.0 through 7.0.0.1

Description: The issue affects the security constraints and roles for Servlets and Enterprise JavaBeans (EJB) when running on multiple servers. If an application is undeployed on one server, the security constraints and roles are removed on all servers for the affected Servlets or EJB, potentially allowing remote attackers to conduct unauthorized activities.

Recommendations: For BEA WebLogic Server and Express versions 7.0 through 7.0.0.1, consider redeploying the application with the intended security constraints and roles to prevent unauthorized access. As a temporary workaround, restrict access to the affected Servlets and EJB until a proper fix can be applied.

Correção

Identificadores relacionados

CVE-2002-2141

Produtos afetados

Bea Weblogic Express

Bea Weblogic Server

Referências · 5

• http://iss.net/security_center/static/10291.php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-2141 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2141 · Nota
• http://securityfocus.com/bid/5846 · Nota
• http://dev2dev.bea.com/pub/advisory/39 · Aviso do Fabricante