Description
The Web Services fat client for BEA WebLogic Server and Express 7.0 SP4 and earlier, when using 2-way SSL and multiple certificates to connect to the same URL, may use the incorrect identity after the first connection, which could allow users to gain privileges.
References
- VU#858990 third-party-advisory
- weblogic-multiple-connection-gain-access(15826) vdb-entry
- 10725 third-party-advisory
- 9502 vdb-entry
- http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_47.00.jsp