PT-2004-1795 · Bea · Bea Weblogic Express+1

Published 2004-07-21 · Updated 2017-07-11 · CVE-2004-0715

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server versions 7.0 through SP4 BEA WebLogic Server versions 8.1 through SP2 BEA WebLogic Express versions 7.0 through SP4 BEA WebLogic Express versions 8.1 through SP2

Description The issue arises from the WebLogic Authentication provider not properly clearing member relationships when a group is deleted. This can lead to a new group with the same name inheriting the members of the old group, potentially allowing group members to gain privileges.

Recommendations For BEA WebLogic Server versions 7.0 through SP4, update the authentication provider to properly handle group deletions. For BEA WebLogic Server versions 8.1 through SP2, update the authentication provider to properly handle group deletions. For BEA WebLogic Express versions 7.0 through SP4, update the authentication provider to properly handle group deletions. For BEA WebLogic Express versions 8.1 through SP2, update the authentication provider to properly handle group deletions.

Fix

Related Identifiers

CVE-2004-0715

Affected Products

Bea Weblogic Express

Bea Weblogic Server

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2004-0715 · Security Note
• http://securityfocus.com/bid/10130 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15861 · Note
• http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_52.01.jsp · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0715 · Note
• http://securitytracker.com/id?1009763 · Note
• http://osvdb.org/5299 · Note
• http://secunia.com/advisories/11356 · Note
• http://kb.cert.org/vuls/id/470470 · Note