PT-2003-2392 · Ibm · Ibm Websphere Advanced Server Edition

Jan P. Monsch · Published 2003-12-31 · Updated 2017-07-29 · CVE-2003-1447

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere Advanced Server Edition version 4.0.4

Description The issue concerns the use of a weak encryption algorithm, specifically XOR and base64 encoding, which allows local users to decrypt passwords when the configuration file is exported to XML.

Recommendations For IBM WebSphere Advanced Server Edition version 4.0.4, consider updating the encryption algorithm to a more secure method to prevent password decryption. As a temporary workaround, restrict access to the configuration file to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2003-1447

Affected Products

Ibm Websphere Advanced Server Edition

References · 7

• 🔥 http://securityfocus.com/archive/1/310118 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2003-1447 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1447 · Note
• http://securityfocus.com/archive/1/310796 · Note
• http://securityreason.com/securityalert/3277 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11245 · Note
• http://securityfocus.com/bid/6758 · Note