PT-2004-3586 · Bea · Bea Weblogic Server+1

Published 2004-12-31 · Updated 2017-07-29 · CVE-2004-2696

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server and WebLogic Express versions 6.1, 7.0, and 8.1

Description The issue arises when BEA WebLogic Server and WebLogic Express use Remote Method Invocation (RMI) over Internet Inter-ORB Protocol (IIOP) and fail to properly handle multiple logins for different users coming from the same client. This could lead to an "unexpected user identity" being used in an RMI call.

Recommendations For versions 6.1, 7.0, and 8.1, consider restricting access to RMI calls over IIOP to minimize the risk of exploitation until a proper fix is applied. As a temporary workaround, consider implementing additional authentication mechanisms to ensure the correct user identity is used in RMI calls.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2004-2696

Affected Products

Bea Weblogic Server

Weblogic Express

References · 8

• http://secunia.com/advisories/11865 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-2696 · Security Note
• http://dev2dev.bea.com/pub/advisory/59 · Vendor Advisory
• http://securitytracker.com/id?1010493 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2696 · Note
• http://osvdb.org/7081 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16421 · Note
• http://securityfocus.com/bid/10545 · Note