PT-2004-1590 · Bea · Oracle Weblogic Server+2

Published 2004-05-20 · Updated 2017-07-11 · CVE-2004-0470

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server and WebLogic Express versions 7.0 through SP5 and 8.1 through SP2

Description The issue arises when editing weblogic.xml using WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method. If weblogic.xml does not have a principal-name tag, security-role-assignment tags are inadvertently removed. This can lead to the removal of intended access restrictions for the associated web application.

Recommendations For versions 7.0 through SP5 and 8.1 through SP2, ensure that a principal-name tag is present in weblogic.xml before editing it using WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method to prevent the removal of security-role-assignment tags. As a temporary workaround, consider manually adding the necessary security-role-assignment tags after editing weblogic.xml to maintain intended access restrictions.

Fix

Related Identifiers

CVE-2004-0470

Affected Products

Weblogic Builder

Weblogic Express

Oracle Weblogic Server

References · 9

• http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_59.00.jsp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0470 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16123 · Note
• http://securityfocus.com/bid/10328 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0470 · Note
• http://securitytracker.com/id?1010128 · Note
• http://kb.cert.org/vuls/id/950070 · Note
• http://osvdb.org/6076 · Note
• http://secunia.com/advisories/11593 · Note