PT-2004-1791 · Bea · Bea Weblogic Server

Publicado 2004-07-21 · Atualizado 2017-07-11 · CVE-2004-0711

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server versions 6.x through 7.x

Description The issue concerns the URL pattern matching feature in the affected software, which improperly handles certain patterns. Specifically, it treats illegal patterns ending in "" as wildcards, similar to the legal "/" pattern. This could allow remote attackers to bypass intended access restrictions because the illegal patterns are not properly rejected.

Recommendations For BEA WebLogic Server versions 6.x through 7.x, update the URL pattern matching feature to properly reject illegal patterns ending in "*" to prevent bypassing of access restrictions.

Correção

Identificadores relacionados

CVE-2004-0711

Produtos afetados

Bea Weblogic Server

Referências · 6

• https://exchange.xforce.ibmcloud.com/vulnerabilities/15927 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-0711 · Nota de Segurança
• http://securityfocus.com/bid/10184 · Aviso do Fabricante
• http://kb.cert.org/vuls/id/184558 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0711 · Nota
• http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_56.00.jsp · Nota