PT-2004-3214 · Bea · Bea Weblogic Server

Published 2004-12-31 · Updated 2026-05-28 · CVE-2004-2320

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: BEA WebLogic Server and Express versions 5.1 through SP13 BEA WebLogic Server and Express versions 6.1 through SP6 BEA WebLogic Server and Express versions 7.0 through SP4 BEA WebLogic Server and Express versions 8.1 through SP2

Description: The default configuration of the software responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting.

Recommendations: For versions 5.1 through SP13, consider disabling the HTTP TRACE request to prevent cross-site tracing attacks. For versions 6.1 through SP6, consider disabling the HTTP TRACE request to prevent cross-site tracing attacks. For versions 7.0 through SP4, consider disabling the HTTP TRACE request to prevent cross-site tracing attacks. For versions 8.1 through SP2, consider disabling the HTTP TRACE request to prevent cross-site tracing attacks.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2004-2320

Affected Products

Bea Weblogic Server

References · 11

• http://securitytracker.com/alerts/2004/Jan/1008866.html · Patch
• http://dev2dev.bea.com/pub/advisory/68 · Vendor Advisory
• http://secunia.com/advisories/10726 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-2320 · Security Note
• http://securityfocus.com/bid/9506 · Patch
• https://t.me/cveNotify/165085 · Telegram Post
• https://t.me/cveNotify/133884 · Telegram Post
• https://t.me/cveNotify/133947 · Telegram Post
• http://kb.cert.org/vuls/id/867593 · Note
• http://osvdb.org/3726 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/14959 · Note