PT-2003-2166 · Bea · Bea Weblogic Server+1

Publicado 2003-12-31 · Atualizado 2008-09-10 · CVE-2003-1221

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic Express and Server versions 7.0 through 8.1 SP 1

Description The issue arises under certain circumstances when a request to use T3 over SSL (t3s) is made to the insecure T3 port. As a result, the system may use a non-SSL connection for communication, potentially allowing attackers to sniff sessions.

Recommendations For BEA WebLogic Express and Server versions 7.0 through 8.1 SP 1, consider configuring the server to only accept SSL connections on the T3 port to prevent the use of non-SSL connections. Additionally, restrict access to the T3 port to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2003-1221

Produtos afetados

Bea Weblogic Express

Bea Weblogic Server

Referências · 4

• http://securityfocus.com/bid/9034 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2003-1221 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1221 · Nota
• http://dev2dev.bea.com/pub/advisory/32 · Aviso do Fabricante