Vulnerability CVE-2003-1224 - CERT Civis.Net

Vulnerability Name:

CVE-2003-1224 (CCN-11989)

Assigned:

2003-05-12

Published:

2003-05-12

Updated:

2008-09-10

Summary:

Weblogic.admin for BEA WebLogic Server and Express 7.0 and 7.0.0.1 displays the JDBCConnectionPoolRuntimeMBean password to the screen in cleartext, which allows attackers to read a user's password by physically observing ("shoulder surfing") the screen.

CVSS v3 Severity:

4.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): None

CVSS v2 Severity:

2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

2.1 Low (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Obtain Information

References:

Source: MITRE
Type: CNA
CVE-2003-1224

Source: CCN
Type: BEA Systems, Inc. Security Advisory (BEA03-30.00)
Patch available to prevent clear-text passwords

Source: BEA
Type: UNKNOWN
BEA03-30.00

Source: CCN
Type: OSVDB ID: 19801
BEA WebLogic Weblogic.admin JDBCConnectionPoolRuntimeMBean Cleartext Password Disclosure

Source: BID
Type: Patch
7563

Source: CCN
Type: BID-7563
BEA Systems WebLogic Multiple Password Storage Vulnerabilities

Source: CCN
Type: BID-7591
BEA WebLogic JDBCConnectionPoolRuntimeMBean On-Screen Password Disclosure Vulnerability

Source: XF
Type: UNKNOWN
webLogic-jdbc-plaintext-password(11989)

Vulnerable Configuration:

Configuration 1:

cpe:/a:bea:weblogic_server:7.0:*:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:*:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0.0.1:*:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0.0.1:*:win32:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0.0.1:sp1:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0.0.1:sp1:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0.0.1:sp1:win32:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0.0.1:sp2:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0.0.1:sp2:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0.0.1:sp2:win32:*:*:*:*:*

Denotes that component is vulnerable