PT-2004-1793 · Bea · Weblogic Express+1

Publicado 2004-07-21 · Atualizado 2017-07-11 · CVE-2004-0713

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server and WebLogic Express versions 6.1 through SP6 BEA WebLogic Server and WebLogic Express versions 7.0 through SP4 BEA WebLogic Server and WebLogic Express versions 8.1 through SP2

Description The issue is related to the remove method in a stateful Enterprise JavaBean (EJB) which does not properly check EJB permissions before unexporting a bean. This allows remote authenticated users to remove EJB objects from remote views before the security exception is thrown.

Recommendations For BEA WebLogic Server and WebLogic Express versions 6.1 through SP6, update to a version that includes the security fix. For BEA WebLogic Server and WebLogic Express versions 7.0 through SP4, update to a version that includes the security fix. For BEA WebLogic Server and WebLogic Express versions 8.1 through SP2, update to a version that includes the security fix.

Correção

Identificadores relacionados

CVE-2004-0713

Produtos afetados

Bea Weblogic Server

Weblogic Express

Referências · 6

• http://securityfocus.com/bid/10185 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-0713 · Nota de Segurança
• http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_57.00.jsp · Nota
• http://kb.cert.org/vuls/id/658878 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15928 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0713 · Nota