PT-2003-2050 · Bea · Bea Weblogic Server

Publicado 2003-03-18 · Atualizado 2017-07-11 · CVE-2003-1095

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server and Express versions 7.0 through 7.0.0.1

Description The issue arises when using "memory" session persistence for web applications. It does not clear authentication information when a web application is redeployed. This could allow users of that application to gain access without having to re-authenticate.

Recommendations For versions 7.0 through 7.0.0.1, consider disabling the "memory" session persistence for web applications until a fix is available. As a temporary workaround, restrict access to sensitive areas of the application to minimize the risk of unauthorized access.

Correção

Identificadores relacionados

CVE-2003-1095

Produtos afetados

Bea Weblogic Server

Referências · 6

• http://kb.cert.org/vuls/id/691153 · Correção
• http://securityfocus.com/bid/7130 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11555 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2003-1095 · Nota de Segurança
• http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-27.jsp · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1095 · Nota