PT-2005-2715 · Bea · Weblogic Express+1

Published 2005-05-24 · Updated 2018-10-30 · CVE-2005-1743

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server and WebLogic Express versions 8.1 through Service Pack 3 BEA WebLogic Server and WebLogic Express versions 7.0 through Service Pack 5

Description The issue arises when a security provider throws an exception, which may cause the server to use an incorrect identity for the thread or fail to audit security exceptions.

Recommendations For versions 8.1 through Service Pack 3, update to a version later than Service Pack 3. For versions 7.0 through Service Pack 5, update to a version later than Service Pack 5. As a temporary workaround, consider restricting access to security-sensitive operations until a patch is available.

Fix

Related Identifiers

CVE-2005-1743

Affected Products

Bea Weblogic Server

Weblogic Express

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2005-1743 · Security Note
• http://secunia.com/advisories/15486 · Vendor Advisory
• http://dev2dev.bea.com/pub/advisory/126 · Vendor Advisory
• http://securityfocus.com/bid/13717 · Note
• http://securitytracker.com/id?1014049 · Note
• http://vupen.com/english/advisories/2005/0603 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1743 · Note