PT-2003-2383 · Bea · Bea Weblogic Server

Published 2003-12-31 · Updated 2017-07-29 · CVE-2003-1438

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server and Express versions 5.1 through 7.0.0.1

Description A race condition issue exists when using in-memory session replication or replicated stateful session beans. This could cause the same buffer to be provided to two users, potentially allowing one user to see session data intended for another user.

Recommendations For versions 5.1 through 7.0.0.1, consider disabling in-memory session replication or replicated stateful session beans as a temporary workaround until a patch is available. Restrict access to sensitive session data to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2003-1438

Affected Products

Bea Weblogic Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2003-1438 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1438 · Note
• http://dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-26.01.jsp · Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11221 · Note
• http://securityfocus.com/bid/6717 · Note
• http://securitytracker.com/id?1006018 · Note