First published: Wed Dec 31 2003(Updated: )
BEA WebLogic Express and WebLogic Server 7.0 and 7.0.0.1, stores passwords in plaintext when a keystore is used to store a private key or trust certificate authorities, which allows local users to gain access.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
HPE HP-UX | =11.00 | |
HPE HP-UX | =11.11i-v1 | |
IBM AIX | =4.3.3 | |
Microsoft Windows 2000 | ||
Microsoft Windows NT | ||
Red Hat Linux | =6.2 | |
Red Hat Linux | =7.1 | |
Oracle Solaris SPARC | =2.6 | |
Sun SunOS | =5.7 | |
Sun SunOS | =5.8 | |
Oracle WebLogic Server | =7.0 | |
Oracle WebLogic Server | =7.0-sp1 | |
Oracle WebLogic Server | =7.0.0.1 | |
Oracle WebLogic Server | =7.0.0.1-sp1 | |
HPE HP-UX | =11.11i | |
Oracle WebLogic Server | =7.0 | |
Oracle WebLogic Server | =7.0-sp1 | |
Oracle WebLogic Server | =7.0.0.1 | |
Oracle WebLogic Server | =7.0.0.1-sp1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2003-1437 is considered a high severity vulnerability due to the risk of local users gaining access to sensitive passwords stored in plaintext.
To fix CVE-2003-1437, it is recommended to update to a patched version of BEA WebLogic Server that properly secures stored passwords.
CVE-2003-1437 affects BEA WebLogic Express and WebLogic Server versions 7.0 and 7.0.0.1.
The impact of CVE-2003-1437 on data security includes unauthorized access to sensitive information since passwords are stored in plaintext.
CVE-2003-1437 can be exploited by local users who have access to the system where the vulnerable WebLogic Server is installed.