PT-2004-1791 · Bea · Bea Weblogic Server

Published 2004-07-21 · Updated 2017-07-11 · CVE-2004-0711

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server versions 6.x through 7.x

Description The issue concerns the URL pattern matching feature in the affected software, which improperly handles certain patterns. Specifically, it treats illegal patterns ending in "" as wildcards, similar to the legal "/" pattern. This could allow remote attackers to bypass intended access restrictions because the illegal patterns are not properly rejected.

Recommendations For BEA WebLogic Server versions 6.x through 7.x, update the URL pattern matching feature to properly reject illegal patterns ending in "*" to prevent bypassing of access restrictions.

Fix

Related Identifiers

CVE-2004-0711

Affected Products

Bea Weblogic Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2004-0711 · Security Note
• http://securityfocus.com/bid/10184 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15927 · Note
• http://kb.cert.org/vuls/id/184558 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0711 · Note
• http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_56.00.jsp · Note