PT-2003-1828 · Oracle · Weblogic Integration+3

Published 2003-09-04 · Updated 2008-09-05 · CVE-2003-0733

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: WebLogic Integration versions 2.0 through 7.0 WebLogic Server and Express versions 5.1 through 7.0 Liquid Data version 1.1

Description: The issue allows remote attackers to execute arbitrary web script and potentially steal authentication credentials. This can be achieved via a forward instruction to the Servlet container or through other vulnerabilities in the WebLogic Server console application.

Recommendations: For WebLogic Integration versions 2.0 through 7.0, update to a version that includes the fix for this issue. For WebLogic Server and Express versions 5.1 through 7.0, update to a version that includes the fix for this issue. For Liquid Data version 1.1, update to a version that includes the fix for this issue.

Fix

Related Identifiers

CVE-2003-0733

Affected Products

Liquid Data

Weblogic Express

Weblogic Integration

Oracle Weblogic Server

References · 4

• http://securityfocus.com/bid/8357 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0733 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0733 · Note
• http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/SA_BEA03_36.00.jsp · Note