CVE-2003-1438

Published: Dec 31, 2003Modified: Apr 16, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Race condition in BEA WebLogic Server and Express 5.1 through 7.0.0.1, when using in-memory session replication or replicated stateful session beans, causes the same buffer to be provided to two users, which could allow one user to see session data that was intended for another user.

Affected (5)

Products: Bea: Weblogic Server

1 product

Weblogic Server

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Bea Weblogic Server	Version 5.1
Bea Weblogic Server	Version 6.0
Bea Weblogic Server	Version 6.1
Bea Weblogic Server	Version 7.0.0.1
Bea Weblogic Server	Version 7.0

Related CWEs

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

References (8)

http://dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-26.01.jsp

Source: cve@mitre.org

Patch

http://www.securityfocus.com/bid/6717

Source: cve@mitre.org

http://www.securitytracker.com/id?1006018

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/11221

Source: cve@mitre.org

http://dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-26.01.jsp

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.securityfocus.com/bid/6717

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1006018

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/11221

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.