PT-2003-2169 · Bea · Bea Weblogic Server

Published 2003-12-31 · Updated 2008-09-10 · CVE-2003-1224

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server and Express versions 7.0 through 7.0.0.1

Description The issue allows attackers to obtain a user's password by physically observing the screen, as the JDBCConnectionPoolRuntimeMBean password is displayed in cleartext. This can be achieved through "shoulder surfing", where an attacker reads the password from the screen.

Recommendations For versions 7.0 through 7.0.0.1, consider restricting access to the Weblogic.admin console to minimize the risk of exploitation. As a temporary workaround, ensure that the console is used in a secure environment where "shoulder surfing" is not possible. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2003-1224

Affected Products

Bea Weblogic Server

References · 4

• http://dev2dev.bea.com/pub/advisory/22 · Vendor Advisory
• http://securityfocus.com/bid/7563 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2003-1224 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1224 · Note