CVE-2004-2320

Description

The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected products

bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server5.1 – 5.1
bea / weblogic_server6.1 – 6.1
bea / weblogic_server6.1 – 6.1
bea / weblogic_server6.1 – 6.1
bea / weblogic_server6.1 – 6.1
bea / weblogic_server6.1 – 6.1
bea / weblogic_server6.1 – 6.1
bea / weblogic_server6.1 – 6.1
bea / weblogic_server6.1 – 6.1
bea / weblogic_server6.1 – 6.1
bea / weblogic_server6.1 – 6.1
bea / weblogic_server6.1 – 6.1
bea / weblogic_server6.1 – 6.1
bea / weblogic_server6.1 – 6.1
bea / weblogic_server6.1 – 6.1
bea / weblogic_server6.1 – 6.1
bea / weblogic_server6.1 – 6.1
bea / weblogic_server6.1 – 6.1
bea / weblogic_server6.1 – 6.1
bea / weblogic_server6.1 – 6.1
bea / weblogic_server6.1 – 6.1
bea / weblogic_server7.0 – 7.0
bea / weblogic_server7.0 – 7.0
bea / weblogic_server7.0 – 7.0
bea / weblogic_server7.0 – 7.0
bea / weblogic_server7.0 – 7.0
bea / weblogic_server7.0 – 7.0
bea / weblogic_server7.0 – 7.0
bea / weblogic_server7.0 – 7.0
bea / weblogic_server7.0 – 7.0
bea / weblogic_server7.0 – 7.0
bea / weblogic_server7.0 – 7.0
bea / weblogic_server7.0 – 7.0
bea / weblogic_server7.0 – 7.0
bea / weblogic_server7.0 – 7.0
bea / weblogic_server7.0 – 7.0
bea / weblogic_server8.1 – 8.1
bea / weblogic_server8.1 – 8.1
bea / weblogic_server8.1 – 8.1
bea / weblogic_server8.1 – 8.1
bea / weblogic_server8.1 – 8.1
bea / weblogic_server8.1 – 8.1
bea / weblogic_server8.1 – 8.1
bea / weblogic_server8.1 – 8.1
bea / weblogic_server8.1 – 8.1

References

MISChttps://exchange.xforce.ibmcloud.com/vulnerabilities/14959
MISChttp://www.kb.cert.org/vuls/id/867593
MISChttp://dev2dev.bea.com/pub/advisory/68
MISChttp://www.securityfocus.com/bid/9506
VENDOR_ADVISORYhttp://secunia.com/advisories/10726
MISChttp://www.securitytracker.com/alerts/2004/Jan/1008866.html
MISChttp://www.osvdb.org/3726