CVE-2003-1095: Medium severity Bea WebLogic Server vulnerability
BEA WebLogic Server and Express 7.0 and 7.0.0.1, when using "memory" session persistence for web applications, does not clear authentication information when a web application is redeployed, which could allow users of that application to gain access without having to re-authenticate.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2003-1095?
CVE-2003-1095 is considered a high severity vulnerability due to the potential for unauthorized access.
How do I fix CVE-2003-1095?
To fix CVE-2003-1095, update to a version of BEA WebLogic Server that does not use memory session persistence for web applications.
What are the potential impacts of exploiting CVE-2003-1095?
Exploiting CVE-2003-1095 could allow users to access sensitive information without re-authenticating, compromising application security.
Which versions of WebLogic Server are affected by CVE-2003-1095?
CVE-2003-1095 affects BEA WebLogic Server and Express versions 7.0 and 7.0.0.1, including their service packs.
Is there a workaround for CVE-2003-1095?
A possible workaround for CVE-2003-1095 is to disable the use of memory session persistence in affected WebLogic configurations.