CVE-2003-1095

MediumCVSS 4.6/10Last modified Jun 16, 2026

Description

BEA WebLogic Server and Express 7.0 and 7.0.0.1, when using "memory" session persistence for web applications, does not clear authentication information when a web application is redeployed, which could allow users of that application to gain access without having to re-authenticate.

Metrics

CVSS 2.0 4.6/10AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-27.jsp
http://www.kb.cert.org/vuls/id/691153Patch, Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/7130Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/11555
http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-27.jsp
http://www.kb.cert.org/vuls/id/691153Patch, Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/7130Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/11555

Timeline

Published: Mar 18, 2003
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2003

CVE-2003-109610.0The Cisco LEAP challenge/response authentication mechanism uses passwords in a way that is susceptible to dictionary attacks, which makes it CVE-2003-10977.2Buffer overflow in rexec on HP-UX B.10.20, B.11.00, and B.11.04, when setuid root, may allow local users to gain privileges via a long -l op CVE-2003-10987.2The Xserver for HP-UX 11.22 was not properly built, which introduced a vulnerability that allows local users to gain privileges.CVE-2003-10992.1shar on HP-UX B.11.00, B.11.04, and B.11.11 creates temporary files with predictable names in /tmp, which allows local users to cause a deni CVE-2003-11004.3Multiple cross-site scripting (XSS) vulnerabilities in Hummingbird CyberDOCS 3.5.1, 3.9, and 4.0 allow remote attackers to inject arbitrary CVE-2003-11015.0Hummingbird CyberDOCS 3.5.1, 3.9, and 4.0 allows remote attackers to obtain the full path of the DM Web Server via invalid login credentials CVE-2003-11025.0Hummingbird CyberDOCS 3.5, 3.9, and 4.0, when running on IIS, uses insecure permissions for script source code files, which allows remote at CVE-2003-11037.5SQL injection vulnerability in loginact.asp for Hummingbird CyberDOCS before 3.9 allows remote attackers to execute arbitrary SQL commands.CVE-2003-110410.0Buffer overflow in IBM Tivoli Firewall Toolbox (TFST) 1.2 allows remote attackers to execute arbitrary code via unknown vectors.CVE-2003-11052.6Unknown vulnerability in Internet Explorer 5.01 SP3 through 6.0 SP1 allows remote attackers to cause a denial of service (browser or Outlook CVE-2003-11065.0The SMTP service in Microsoft Windows 2000 before SP4 allows remote attackers to cause a denial of service (crash or hang) via an e-mail mes CVE-2003-11075.1The DHTML capability in Microsoft Windows Media Player (WMP) 6.4, 7.0, 7.1, and 9 may run certain URL commands from a security zone that is