Lucene search

[email protected]CVE-2004-2696

HistoryDec 31, 2004 - 5:00 a.m.

CVE-2004-2696

2004-12-3105:00:00

CWE-255

[email protected]

web.nvd.nist.gov

cve-2004-2696

bea weblogic

weblogic server

weblogic express

rmi

iiop

security vulnerability

nvd

7.3 High

AI Score

Confidence

Low

5.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

0.002 Low

EPSS

Percentile

59.5%

JSON

BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, when using Remote Method Invocation (RMI) over Internet Inter-ORB Protocol (IIOP), does not properly handle when multiple logins for different users coming from the same client, which could cause an “unexpected user identity” to be used in an RMI call.

CPENameOperatorVersion
bea:weblogic_serverbea weblogic servereq8.1
bea:weblogic_serverbea weblogic servereq7.0
bea:weblogic_serverbea weblogic servereq7.0.0.1
bea:weblogic_serverbea weblogic servereq6.1

CPE	Name	Operator	Version
bea:weblogic_server	bea weblogic server	eq	8.1
bea:weblogic_server	bea weblogic server	eq	7.0
bea:weblogic_server	bea weblogic server	eq	7.0.0.1
bea:weblogic_server	bea weblogic server	eq	6.1

References

dev2dev.bea.com/pub/advisory/59

secunia.com/advisories/11865

securitytracker.com/id?1010493

www.osvdb.org/7081

www.securityfocus.com/bid/10545

exchange.xforce.ibmcloud.com/vulnerabilities/16421

7.3 High

AI Score

Confidence

Low

5.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

0.002 Low

EPSS

Percentile

59.5%

JSON

Related for CVE-2004-2696

cvelist1