PT-2003-2167 · Bea · Bea Weblogic

Publicado 2003-12-31 · Atualizado 2008-09-10 · CVE-2003-1222

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions BEA Weblogic Express and Server versions 8.0 through 8.1 SP 1

Description The issue allows attackers to obtain the password for a foreign Java Message Service (JMS) provider. When using such a provider, the password is echoed to the console and stored in cleartext in config.xml.

Recommendations For versions 8.0 through 8.1 SP 1, consider restricting access to the config.xml file to minimize the risk of password exposure. As a temporary workaround, avoid using foreign JMS providers until a fix is available.

Correção

Identificadores relacionados

CVE-2003-1222

Produtos afetados

Bea Weblogic

Referências · 4

• http://dev2dev.bea.com/pub/advisory/63 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1222 · Nota
• http://securityfocus.com/bid/9034 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2003-1222 · Nota de Segurança