CVE-2003-1290
First published: Wed Dec 31 2003(Updated: )
BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, with RMI and anonymous admin lookup enabled, allows remote attackers to obtain configuration information by accessing MBeanHome via the Java Naming and Directory Interface (JNDI).
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle WebLogic Server | =6.0 | |
| Oracle WebLogic Server | =6.0-sp1 | |
| Oracle WebLogic Server | =6.0-sp1 | |
| Oracle WebLogic Server | =6.0-sp2 | |
| Oracle WebLogic Server | =6.0-sp2 | |
| Oracle WebLogic Server | =6.1 | |
| Oracle WebLogic Server | =6.1-sp1 | |
| Oracle WebLogic Server | =6.1-sp1 | |
| Oracle WebLogic Server | =6.1-sp2 | |
| Oracle WebLogic Server | =6.1-sp2 | |
| Oracle WebLogic Server | =6.1-sp3 | |
| Oracle WebLogic Server | =6.1-sp3 | |
| Oracle WebLogic Server | =6.1-sp4 | |
| Oracle WebLogic Server | =6.1-sp4 | |
| Oracle WebLogic Server | =6.1-sp4 | |
| Oracle WebLogic Server | =6.1-sp5 | |
| Oracle WebLogic Server | =6.1-sp5 | |
| Oracle WebLogic Server | =6.1-sp5 | |
| Oracle WebLogic Server | =6.1-sp6 | |
| Oracle WebLogic Server | =6.1-sp6 | |
| Oracle WebLogic Server | =7.0 | |
| Oracle WebLogic Server | =7.0-sp1 | |
| Oracle WebLogic Server | =7.0-sp1 | |
| Oracle WebLogic Server | =7.0-sp1 | |
| Oracle WebLogic Server | =7.0-sp2 | |
| Oracle WebLogic Server | =7.0-sp2 | |
| Oracle WebLogic Server | =7.0-sp3 | |
| Oracle WebLogic Server | =7.0-sp3 | |
| Oracle WebLogic Server | =7.0-sp3 | |
| Oracle WebLogic Server | =7.0-sp4 | |
| Oracle WebLogic Server | =7.0-sp4 | |
| Oracle WebLogic Server | =7.0-sp4 | |
| Oracle WebLogic Server | =7.0-sp5 | |
| Oracle WebLogic Server | =7.0-sp5 | |
| Oracle WebLogic Server | =7.0-sp5 | |
| Oracle WebLogic Server | =7.0.0.1 | |
| Oracle WebLogic Server | =7.0.0.1-sp1 | |
| Oracle WebLogic Server | =7.0.0.1-sp1 | |
| Oracle WebLogic Server | =7.0.0.1-sp2 | |
| Oracle WebLogic Server | =7.0.0.1-sp2 | |
| Oracle WebLogic Server | =7.0.0.1-sp3 | |
| Oracle WebLogic Server | =7.0.0.1-sp3 | |
| Oracle WebLogic Server | =7.0.0.1-sp4 | |
| Oracle WebLogic Server | =7.0.0.1-sp4 | |
| Oracle WebLogic Server | =8.1 | |
| Oracle WebLogic Server | =8.1 | |
| Oracle WebLogic Server | =8.1-sp1 | |
| Oracle WebLogic Server | =8.1-sp1 | |
| Oracle WebLogic Server | =8.1-sp1 | |
| Oracle WebLogic Server | =8.1-sp2 | |
| Oracle WebLogic Server | =8.1-sp2 | |
| Oracle WebLogic Server | =8.1-sp2 | |
| Oracle WebLogic Server | =8.1-sp3 | |
| Oracle WebLogic Server | =8.1-sp3 | |
| Oracle WebLogic Server | =8.1-sp3 | |
| Oracle WebLogic Server | =8.1-sp4 | |
| Oracle WebLogic Server | =8.1-sp4 | |
| Oracle WebLogic Server | =8.1-sp4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2003-1290?
CVE-2003-1290 is considered a medium severity vulnerability due to its potential for unauthorized access to sensitive configuration information.
How do I fix CVE-2003-1290?
To remediate CVE-2003-1290, disable RMI and anonymous admin lookup features in the affected versions of BEA WebLogic Server.
Which versions of WebLogic are affected by CVE-2003-1290?
CVE-2003-1290 affects BEA WebLogic Server versions 6.1, 7.0, and 8.1 with RMI and anonymous admin lookup enabled.
What can attackers achieve with CVE-2003-1290?
Attackers exploiting CVE-2003-1290 can obtain sensitive configuration information through unauthorized access.
Is there a patch available for CVE-2003-1290?
Yes, Oracle released updates that address CVE-2003-1290, and it is recommended to apply them to mitigate the vulnerability.
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/weakness
- agent/author
- agent/severity
- agent/last-modified-date
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/bea
- canonical/oracle weblogic server
- version/oracle weblogic server/6.0
- version/oracle weblogic server/6.0-sp1
- version/oracle weblogic server/6.0-sp2
- version/oracle weblogic server/6.1
- version/oracle weblogic server/6.1-sp1
- version/oracle weblogic server/6.1-sp2
- version/oracle weblogic server/6.1-sp3
- version/oracle weblogic server/6.1-sp4
- version/oracle weblogic server/6.1-sp5
- version/oracle weblogic server/6.1-sp6
- version/oracle weblogic server/7.0
- version/oracle weblogic server/7.0-sp1
- version/oracle weblogic server/7.0-sp2
- version/oracle weblogic server/7.0-sp3
- version/oracle weblogic server/7.0-sp4
- version/oracle weblogic server/7.0-sp5
- version/oracle weblogic server/7.0.0.1
- version/oracle weblogic server/7.0.0.1-sp1
- version/oracle weblogic server/7.0.0.1-sp2
- version/oracle weblogic server/7.0.0.1-sp3
- version/oracle weblogic server/7.0.0.1-sp4
- version/oracle weblogic server/8.1
- version/oracle weblogic server/8.1-sp1
- version/oracle weblogic server/8.1-sp2
- version/oracle weblogic server/8.1-sp3
- version/oracle weblogic server/8.1-sp4