CVE-2005-1744
CriticalSummary
Vulnerability in BEA WebLogic Server and WebLogic Express versions 7.0 through Service Pack 5 fails to log out users when an application is redeployed, allowing continued access without re-authentication, potentially violating updated security constraints or role mappings.
Risk Assessment
The risk is that users may gain unauthorized access to the application after security policy changes, potentially leading to data confidentiality or integrity breaches.
Recommendation
It is recommended to upgrade to a version of WebLogic Server or WebLogic Express later than Service Pack 5, which includes a fix to enforce user logout upon application redeployment.
Original NVD description (English source)
BEA WebLogic Server and WebLogic Express 7.0 through Service Pack 5 does not log out users when an application is redeployed, which allows those users to continue to access the application without having to log in again, which may be in violation of newly changed security constraints or role mappings.