CVE-2003-1290
Summary
| CVE | CVE-2003-1290 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2003-12-31 05:00:00 UTC |
| Updated | 2025-04-03 01:03:51 UTC |
| Description | BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, with RMI and anonymous admin lookup enabled, allows remote attackers to obtain configuration information by accessing MBeanHome via the Java Naming and Directory Interface (JNDI). |
Risk And Classification
Primary CVSS: v2.0 5 from [email protected]
AV:N/AC:L/Au:N/C:P/I:N/A:N
Problem Types: NVD-CWE-Other | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
NoneAvailability
NoneAV:N/AC:L/Au:N/C:P/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Bea | Weblogic Server | 6.0 | All | win32 | All |
| Application | Bea | Weblogic Server | 6.0 | sp1 | express | All |
| Application | Bea | Weblogic Server | 6.0 | sp1 | win32 | All |
| Application | Bea | Weblogic Server | 6.0 | sp2 | express | All |
| Application | Bea | Weblogic Server | 6.0 | sp2 | win32 | All |
| Application | Bea | Weblogic Server | 6.1 | All | win32 | All |
| Application | Bea | Weblogic Server | 6.1 | sp1 | express | All |
| Application | Bea | Weblogic Server | 6.1 | sp1 | win32 | All |
| Application | Bea | Weblogic Server | 6.1 | sp2 | express | All |
| Application | Bea | Weblogic Server | 6.1 | sp2 | win32 | All |
| Application | Bea | Weblogic Server | 6.1 | sp3 | express | All |
| Application | Bea | Weblogic Server | 6.1 | sp3 | win32 | All |
| Application | Bea | Weblogic Server | 6.1 | sp4 | All | All |
| Application | Bea | Weblogic Server | 6.1 | sp4 | express | All |
| Application | Bea | Weblogic Server | 6.1 | sp4 | win32 | All |
| Application | Bea | Weblogic Server | 6.1 | sp5 | All | All |
| Application | Bea | Weblogic Server | 6.1 | sp5 | express | All |
| Application | Bea | Weblogic Server | 6.1 | sp5 | win32 | All |
| Application | Bea | Weblogic Server | 6.1 | sp6 | All | All |
| Application | Bea | Weblogic Server | 6.1 | sp6 | win32 | All |
| Application | Bea | Weblogic Server | 7.0 | All | win32 | All |
| Application | Bea | Weblogic Server | 7.0 | sp1 | All | All |
| Application | Bea | Weblogic Server | 7.0 | sp1 | express | All |
| Application | Bea | Weblogic Server | 7.0 | sp1 | win32 | All |
| Application | Bea | Weblogic Server | 7.0 | sp2 | express | All |
| Application | Bea | Weblogic Server | 7.0 | sp2 | win32 | All |
| Application | Bea | Weblogic Server | 7.0 | sp3 | All | All |
| Application | Bea | Weblogic Server | 7.0 | sp3 | express | All |
| Application | Bea | Weblogic Server | 7.0 | sp3 | win32 | All |
| Application | Bea | Weblogic Server | 7.0 | sp4 | All | All |
| Application | Bea | Weblogic Server | 7.0 | sp4 | express | All |
| Application | Bea | Weblogic Server | 7.0 | sp4 | win32 | All |
| Application | Bea | Weblogic Server | 7.0 | sp5 | All | All |
| Application | Bea | Weblogic Server | 7.0 | sp5 | express | All |
| Application | Bea | Weblogic Server | 7.0 | sp5 | win32 | All |
| Application | Bea | Weblogic Server | 7.0.0.1 | All | win32 | All |
| Application | Bea | Weblogic Server | 7.0.0.1 | sp1 | express | All |
| Application | Bea | Weblogic Server | 7.0.0.1 | sp1 | win32 | All |
| Application | Bea | Weblogic Server | 7.0.0.1 | sp2 | express | All |
| Application | Bea | Weblogic Server | 7.0.0.1 | sp2 | win32 | All |
| Application | Bea | Weblogic Server | 7.0.0.1 | sp3 | All | All |
| Application | Bea | Weblogic Server | 7.0.0.1 | sp3 | express | All |
| Application | Bea | Weblogic Server | 7.0.0.1 | sp4 | All | All |
| Application | Bea | Weblogic Server | 7.0.0.1 | sp4 | express | All |
| Application | Bea | Weblogic Server | 8.1 | All | express | All |
| Application | Bea | Weblogic Server | 8.1 | All | win32 | All |
| Application | Bea | Weblogic Server | 8.1 | sp1 | All | All |
| Application | Bea | Weblogic Server | 8.1 | sp1 | express | All |
| Application | Bea | Weblogic Server | 8.1 | sp1 | win32 | All |
| Application | Bea | Weblogic Server | 8.1 | sp2 | All | All |
| Application | Bea | Weblogic Server | 8.1 | sp2 | express | All |
| Application | Bea | Weblogic Server | 8.1 | sp2 | win32 | All |
| Application | Bea | Weblogic Server | 8.1 | sp3 | All | All |
| Application | Bea | Weblogic Server | 8.1 | sp3 | express | All |
| Application | Bea | Weblogic Server | 8.1 | sp3 | win32 | All |
| Application | Bea | Weblogic Server | 8.1 | sp4 | All | All |
| Application | Bea | Weblogic Server | 8.1 | sp4 | express | All |
| Application | Bea | Weblogic Server | 8.1 | sp4 | win32 | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.osvdb.org/3064 | af854a3a-2127-422b-91ae-364da2661108 | www.osvdb.org | |
| Multiple BEA WebLogic Server/Express Denial of Service and Information Disclosure Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Patch |
| BEA WebLogic Server and WebLogic Express MBean Remote Information Disclosure Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Workaround available to prevent Mbean exposure | af854a3a-2127-422b-91ae-364da2661108 | dev2dev.bea.com | Vendor Advisory |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| Secunia - Advisories - BEA WebLogic MBean Exposure of Configuration Information | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Secunia - Advisories - BEA WebLogic Multiple Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Patch, Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.