PT-2004-3214 · Bea · Bea Weblogic Server

Publicado 2004-12-31 · Atualizado 2026-05-28 · CVE-2004-2320

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: BEA WebLogic Server and Express versions 5.1 through SP13 BEA WebLogic Server and Express versions 6.1 through SP6 BEA WebLogic Server and Express versions 7.0 through SP4 BEA WebLogic Server and Express versions 8.1 through SP2

Description: The default configuration of the software responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting.

Recommendations: For versions 5.1 through SP13, consider disabling the HTTP TRACE request to prevent cross-site tracing attacks. For versions 6.1 through SP6, consider disabling the HTTP TRACE request to prevent cross-site tracing attacks. For versions 7.0 through SP4, consider disabling the HTTP TRACE request to prevent cross-site tracing attacks. For versions 8.1 through SP2, consider disabling the HTTP TRACE request to prevent cross-site tracing attacks.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2004-2320

Produtos afetados

Bea Weblogic Server

Referências · 11

• https://t.me/cveNotify/165085 · Publicação no Telegram
• https://t.me/cveNotify/133884 · Publicação no Telegram
• http://securitytracker.com/alerts/2004/Jan/1008866.html · Correção
• http://dev2dev.bea.com/pub/advisory/68 · Aviso do Fabricante
• https://t.me/cveNotify/133947 · Publicação no Telegram
• http://kb.cert.org/vuls/id/867593 · Nota
• http://secunia.com/advisories/10726 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-2320 · Nota de Segurança
• http://securityfocus.com/bid/9506 · Correção
• http://osvdb.org/3726 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/14959 · Nota