PT-2004-1591 · Bea · Bea Weblogic Server+1

Published 2004-05-20 · Updated 2017-07-11 · CVE-2004-0471

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server and WebLogic Express versions 7.0 through SP5 BEA WebLogic Server and WebLogic Express versions 8.1 through SP2

Description The issue allows unauthorized users to cause a denial of service by shutting down the service, as it does not enforce site restrictions for starting and stopping servers for users in the Admin and Operator security roles.

Recommendations For versions 7.0 through SP5, restrict access to server management functions to prevent unauthorized shutdowns. For versions 8.1 through SP2, limit the privileges of users in the Admin and Operator security roles to prevent service shutdown.

Fix

Related Identifiers

CVE-2004-0471

Affected Products

Bea Weblogic Server

Weblogic Express

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2004-0471 · Security Note
• http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_60.00.jsp · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0471 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16121 · Note
• http://securityfocus.com/bid/10327 · Note
• http://osvdb.org/6077 · Note
• http://securitytracker.com/id?1010129 · Note
• http://secunia.com/advisories/11594 · Note