PT-2004-1590 · Bea · Oracle Weblogic Server+2

Publicado 2004-05-20 · Atualizado 2017-07-11 · CVE-2004-0470

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server and WebLogic Express versions 7.0 through SP5 and 8.1 through SP2

Description The issue arises when editing weblogic.xml using WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method. If weblogic.xml does not have a principal-name tag, security-role-assignment tags are inadvertently removed. This can lead to the removal of intended access restrictions for the associated web application.

Recommendations For versions 7.0 through SP5 and 8.1 through SP2, ensure that a principal-name tag is present in weblogic.xml before editing it using WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method to prevent the removal of security-role-assignment tags. As a temporary workaround, consider manually adding the necessary security-role-assignment tags after editing weblogic.xml to maintain intended access restrictions.

Correção

Identificadores relacionados

CVE-2004-0470

Produtos afetados

Weblogic Builder

Weblogic Express

Oracle Weblogic Server

Referências · 9

• https://exchange.xforce.ibmcloud.com/vulnerabilities/16123 · Nota
• http://securityfocus.com/bid/10328 · Nota
• http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_59.00.jsp · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0470 · Nota
• http://securitytracker.com/id?1010128 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-0470 · Nota de Segurança
• http://kb.cert.org/vuls/id/950070 · Nota
• http://osvdb.org/6076 · Nota
• http://secunia.com/advisories/11593 · Nota