PT-2003-2167 · Bea · Bea Weblogic

Published 2003-12-31 · Updated 2008-09-10 · CVE-2003-1222

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions BEA Weblogic Express and Server versions 8.0 through 8.1 SP 1

Description The issue allows attackers to obtain the password for a foreign Java Message Service (JMS) provider. When using such a provider, the password is echoed to the console and stored in cleartext in config.xml.

Recommendations For versions 8.0 through 8.1 SP 1, consider restricting access to the config.xml file to minimize the risk of password exposure. As a temporary workaround, avoid using foreign JMS providers until a fix is available.

Fix

Related Identifiers

CVE-2003-1222

Affected Products

Bea Weblogic

References · 4

• http://dev2dev.bea.com/pub/advisory/63 · Vendor Advisory
• http://securityfocus.com/bid/9034 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2003-1222 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1222 · Note