PT-2003-2048 · Bea · Bea Weblogic Server

Published 2003-12-31 · Updated 2017-07-11 · CVE-2003-1093

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server versions 6.1, 7.0, 7.0.0.1

Description The issue occurs when routing messages to a JMS target domain that is inaccessible, potentially leading to a password leak when a ResourceAllocationException is thrown.

Recommendations For BEA WebLogic Server versions 6.1, 7.0, 7.0.0.1, consider implementing additional error handling mechanisms to prevent password leakage when encountering inaccessible JMS target domains. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2003-1093

Affected Products

Bea Weblogic Server

References · 6

• http://securityfocus.com/bid/6586 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2003-1093 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1093 · Note
• http://kb.cert.org/vuls/id/331937 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11057 · Note
• http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-24.jsp · Note