CVE-2003-1095 — Weblogic Server vulnerability

3 documents3 sources
Severity
4.6MEDIUMNVD
EPSS
0.5%
top 34.62%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
BEA Weblogic Server
Timeline
PublishedMar 18
Latest updateApr 29

Description

BEA WebLogic Server and Express 7.0 and 7.0.0.1, when using "memory" session persistence for web applications, does not clear authentication information when a web application is redeployed, which could allow users of that application to gain access without having to re-authenticate.

CVSS vector

AV:L/AC:L/C:P/I:P/A:PExploitability: 3.9 | Impact: 6.4

Affected Packages1 packages

▶NVDbea/weblogic_server7.0, 7.0.0.1+1

Patches

Patch: www.kb.cert.org ↗Patch: www.securityfocus.com ↗Patch: www.kb.cert.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-q2w2-9536-7qhm: BEA WebLogic Server and Express 7↗2022-04-29
▶
CVEList
CVE-2003-1095: BEA WebLogic Server and Express 7↗2005-03-10
▶
CVE-2003-1095 — BEA Weblogic Server vulnerability | cvebase