CVE-2003-1225

The default CredentialMapper for BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores passwords in cleartext on disk, which allows local users to extract passwords.

CVSS v2.0 2.1 LOW

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://dev2dev.bea.com/pub/advisory/22
http://www.securityfocus.com/bid/7563	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:bea:weblogic_server:7.0:::::::*
	cpe:2.3:a:bea:weblogic_server:7.0::express:::::
	cpe:2.3:a:bea:weblogic_server:7.0::win32:::::
	cpe:2.3:a:bea:weblogic_server:7.0:sp1::::::
	cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:::::*
	cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:::::*
	cpe:2.3:a:bea:weblogic_server:7.0:sp2::::::
	cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:::::*
	cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:::::*
	cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:::::*
	cpe:2.3:a:bea:weblogic_server:7.0.0.1:::::::*
	cpe:2.3:a:bea:weblogic_server:7.0.0.1::express:::::
	cpe:2.3:a:bea:weblogic_server:7.0.0.1::win32:::::
	cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1::::::
	cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:express:::::*
	cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:win32:::::*
	cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2::::::
	cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:express:::::*
	cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:win32:::::*

History

No history.

Information

Published : 2003-12-31 05:00

Updated : 2008-09-10 19:22

NVD link : CVE-2003-1225

Mitre link : CVE-2003-1225

CVE.ORG link : CVE-2003-1225

JSON object : View

Products Affected

bea

weblogic_server

CWE

NVD-CWE-Other

{"id": "CVE-2003-1225", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2003-12-31T05:00:00.000", "references": [{"url": "http://dev2dev.bea.com/pub/advisory/22", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/7563", "tags": ["Patch"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "The default CredentialMapper for BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores passwords in cleartext on disk, which allows local users to extract passwords."}], "lastModified": "2008-09-10T19:22:43.663", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A5C59B80-279B-45B3-9CC1-5A263681025B"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "74AE35FF-AC1C-435B-8CE9-F40AFFFA3A46"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "25C711BB-E7E0-41D8-985E-5DD386C54637"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:win32:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "38EFE72C-10E5-4EED-B016-D914FA52DE6F"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "32E8797D-1B62-4480-A79D-0345E65699E8"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "071FAD20-D502-4634-852A-4CD06FE8E114"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:win32:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "97E6F518-D320-4655-B698-2D1A82CA3EDA"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2FC1486C-6AC4-44F7-9015-40FD4A341C38"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AB5909DB-B2E2-4358-9D45-C225C6B02360"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:win32:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "04C3F96B-A1FF-4E3E-B059-366E176E5E19"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}