CVE-2003-1447 - Vulnerability Details - OpenCVE

IBM WebSphere Advanced Server Edition 4.0.4 uses a weak encryption algorithm (XOR and base64 encoding), which allows local users to decrypt passwords when the configuration file is exported to XML.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Local

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Ibm	Websphere Application Server

Configuration 1 [-]

cpe:2.3:a:ibm:websphere_application_server:4.0.4:*:advanced_server:*:*:*:*:*

No data.

References

Link	Providers
http://securityreason.com/securityalert/3277
http://www.securityfocus.com/archive/1/310118
http://www.securityfocus.com/archive/1/310796
http://www.securityfocus.com/bid/6758
https://exchange.xforce.ibmcloud.com/vulnerabilities/11245

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-10-23T01:00:00

Updated: 2024-08-08T02:28:03.715Z

Reserved: 2007-10-22T00:00:00

Link: CVE-2003-1447

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2003-12-31T05:00:00.000

Modified: 2025-04-03T01:03:51.193

Link: CVE-2003-1447

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2003-02-04T00:00:00", "descriptions": [{"lang": "en", "value": "IBM WebSphere Advanced Server Edition 4.0.4 uses a weak encryption algorithm (XOR and base64 encoding), which allows local users to decrypt passwords when the configuration file is exported to XML."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-28T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "websphere-xml-weak-encryption(11245)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11245"}, {"name": "20030206 Re: Weak password protection in WebSphere 4.0.4 XML configuration export", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/310796"}, {"name": "6758", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/6758"}, {"name": "20030204 Weak password protection in WebSphere 4.0.4 XML configuration export", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/310118"}, {"name": "3277", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/3277"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2003-1447", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "IBM WebSphere Advanced Server Edition 4.0.4 uses a weak encryption algorithm (XOR and base64 encoding), which allows local users to decrypt passwords when the configuration file is exported to XML."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "websphere-xml-weak-encryption(11245)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11245"}, {"name": "20030206 Re: Weak password protection in WebSphere 4.0.4 XML configuration export", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/310796"}, {"name": "6758", "refsource": "BID", "url": "http://www.securityfocus.com/bid/6758"}, {"name": "20030204 Weak password protection in WebSphere 4.0.4 XML configuration export", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/310118"}, {"name": "3277", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/3277"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-08T02:28:03.715Z"}, "title": "CVE Program Container", "references": [{"name": "websphere-xml-weak-encryption(11245)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11245"}, {"name": "20030206 Re: Weak password protection in WebSphere 4.0.4 XML configuration export", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/310796"}, {"name": "6758", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/6758"}, {"name": "20030204 Weak password protection in WebSphere 4.0.4 XML configuration export", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/310118"}, {"name": "3277", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/3277"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2003-1447", "datePublished": "2007-10-23T01:00:00", "dateReserved": "2007-10-22T00:00:00", "dateUpdated": "2024-08-08T02:28:03.715Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:websphere_application_server:4.0.4:*:advanced_server:*:*:*:*:*", "matchCriteriaId": "EBAD996D-5F30-4280-842C-03A586960EF6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM WebSphere Advanced Server Edition 4.0.4 uses a weak encryption algorithm (XOR and base64 encoding), which allows local users to decrypt passwords when the configuration file is exported to XML."}], "id": "CVE-2003-1447", "lastModified": "2025-04-03T01:03:51.193", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 1.9, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2003-12-31T05:00:00.000", "references": [{"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/3277"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.securityfocus.com/archive/1/310118"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/310796"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/6758"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11245"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/3277"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.securityfocus.com/archive/1/310118"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/310796"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/6758"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11245"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-310"}], "source": "nvd@nist.gov", "type": "Primary"}]}