PT-2003-2383 · Bea · Bea Weblogic Server

Publicado 2003-12-31 · Atualizado 2017-07-29 · CVE-2003-1438

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server and Express versions 5.1 through 7.0.0.1

Description A race condition issue exists when using in-memory session replication or replicated stateful session beans. This could cause the same buffer to be provided to two users, potentially allowing one user to see session data intended for another user.

Recommendations For versions 5.1 through 7.0.0.1, consider disabling in-memory session replication or replicated stateful session beans as a temporary workaround until a patch is available. Restrict access to sensitive session data to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

CVE-2003-1438

Produtos afetados

Bea Weblogic Server

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2003-1438 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1438 · Nota
• http://dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-26.01.jsp · Correção, Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11221 · Nota
• http://securityfocus.com/bid/6717 · Nota
• http://securitytracker.com/id?1006018 · Nota