PT-2003-2382 · Bea · Bea Weblogic Server+1

Published 2003-12-31 · Updated 2018-10-30 · CVE-2003-1437

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic Express and WebLogic Server versions 7.0 and 7.0.0.1

Description The issue allows local users to gain access by storing passwords in plaintext when a keystore is used to store a private key or trust certificate authorities.

Recommendations For BEA WebLogic Express and WebLogic Server versions 7.0 and 7.0.0.1, consider restricting access to the keystore to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2003-1437

Affected Products

Bea Weblogic Express

Bea Weblogic Server

References · 5

• http://dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-25.jsp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-1437 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11220 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1437 · Note
• http://securityfocus.com/bid/6719 · Note