PT-2003-2050 · Bea · Bea Weblogic Server

Published 2003-03-18 · Updated 2017-07-11 · CVE-2003-1095

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server and Express versions 7.0 through 7.0.0.1

Description The issue arises when using "memory" session persistence for web applications. It does not clear authentication information when a web application is redeployed. This could allow users of that application to gain access without having to re-authenticate.

Recommendations For versions 7.0 through 7.0.0.1, consider disabling the "memory" session persistence for web applications until a fix is available. As a temporary workaround, restrict access to sensitive areas of the application to minimize the risk of unauthorized access.

Fix

Related Identifiers

CVE-2003-1095

Affected Products

Bea Weblogic Server

References · 6

• http://kb.cert.org/vuls/id/691153 · Patch
• http://securityfocus.com/bid/7130 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-1095 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11555 · Note
• http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-27.jsp · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1095 · Note