PT-2001-2567 · Oracle · Bea Tuxedo

Published 2001-12-31 · Updated 2017-07-11 · CVE-2001-1477

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BEA Tuxedo version 7.1

Description The issue concerns the Domain gateway in BEA Tuxedo, which fails to perform authorization checks for imported services and qspaces on remote domains, even when an Access Control List (ACL) is in place. This allows users to access services in a remote domain without proper authorization.

Recommendations For BEA Tuxedo version 7.1, consider implementing additional authorization checks for imported services and qspaces on remote domains to restrict unauthorized access until a patch is available.

Fix

Related Identifiers

CVE-2001-1477

Affected Products

Bea Tuxedo

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2001-1477 · Security Note
• http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA00-08.jsp · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6326 · Note