CVE-2004-2320

2004-12-3105:00:00

CWE-200

[email protected]

web.nvd.nist.gov

466

cve-2004-2320

information security

bea weblogic server

express

xst attacks

vulnerability

http trace request

remote attackers

cross-site scripting

5.9 Medium

AI Score

Confidence

High

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.006 Low

EPSS

Percentile

77.4%

JSON

The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting.

CPENameOperatorVersion
bea:weblogic_serverbea weblogic servereq5.1
bea:weblogic_serverbea weblogic servereq8.1
bea:weblogic_serverbea weblogic servereq7.0
bea:weblogic_serverbea weblogic servereq6.1

CPE	Name	Operator	Version
bea:weblogic_server	bea weblogic server	eq	5.1
bea:weblogic_server	bea weblogic server	eq	8.1
bea:weblogic_server	bea weblogic server	eq	7.0
bea:weblogic_server	bea weblogic server	eq	6.1