PT-2003-2169 · Bea · Bea Weblogic Server

Publicado 2003-12-31 · Atualizado 2008-09-10 · CVE-2003-1224

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server and Express versions 7.0 through 7.0.0.1

Description The issue allows attackers to obtain a user's password by physically observing the screen, as the JDBCConnectionPoolRuntimeMBean password is displayed in cleartext. This can be achieved through "shoulder surfing", where an attacker reads the password from the screen.

Recommendations For versions 7.0 through 7.0.0.1, consider restricting access to the Weblogic.admin console to minimize the risk of exploitation. As a temporary workaround, ensure that the console is used in a secure environment where "shoulder surfing" is not possible. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Identificadores relacionados

CVE-2003-1224

Produtos afetados

Bea Weblogic Server

Referências · 4

• http://dev2dev.bea.com/pub/advisory/22 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1224 · Nota
• http://securityfocus.com/bid/7563 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2003-1224 · Nota de Segurança