CVE-2004-2320

MediumCVSS 5.3/10Last modified Jun 16, 2026

Description

The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://dev2dev.bea.com/pub/advisory/68Patch, Vendor Advisory
http://secunia.com/advisories/10726Vendor Advisory
http://www.kb.cert.org/vuls/id/867593Third Party Advisory, US Government Resource
http://www.osvdb.org/3726
http://www.securityfocus.com/bid/9506Patch
http://www.securitytracker.com/alerts/2004/Jan/1008866.htmlPatch
https://exchange.xforce.ibmcloud.com/vulnerabilities/14959
http://dev2dev.bea.com/pub/advisory/68Patch, Vendor Advisory
http://secunia.com/advisories/10726Vendor Advisory
http://www.kb.cert.org/vuls/id/867593Third Party Advisory, US Government Resource
http://www.osvdb.org/3726
http://www.securityfocus.com/bid/9506Patch
http://www.securitytracker.com/alerts/2004/Jan/1008866.htmlPatch
https://exchange.xforce.ibmcloud.com/vulnerabilities/14959

Timeline

Published: Dec 31, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-23212.1BEA WebLogic Server and Express 8.1 SP1 and earlier allows local users in the Operator role to obtain administrator passwords via MBean attr CVE-2004-23227.5SQL injection vulnerability in the (1) announce and (2) notes modules of phpWebSite before 0.9.3-2 allows remote attackers to execute arbitr CVE-2004-23235.0DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote attackers to obtain sensitive information, including the SQL serv CVE-2004-23247.5SQL injection vulnerability in DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote attackers to modify the backend da CVE-2004-23254.3Cross-site scripting (XSS) vulnerability in EditModule.aspx for DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote a CVE-2004-23267.5SQL injection vulnerability in IP3 Networks NetAccess Appliance before firmware 3.1.18b13 allows remote attackers to bypass authentication v CVE-2004-23275.0Vizer Web Server 1.9.1 allows remote attackers to cause a denial of service (crash) via multiple malformed requests including (1) requests w CVE-2004-23285.0Clearswift MAILsweeper for SMTP before 4.3_13 allows remote attackers to cause a denial of service (infinite loop) via an e-mail with a craf CVE-2004-23297.2Kerio Personal Firewall (KPF) 2.1.5 allows local users to execute arbitrary code with SYSTEM privileges via the Load button in the Firewall CVE-2004-23305.0ColdFusion MX 6.1 and 6.1 J2EE allows remote attackers to cause a denial of service via an HTTP request containing a large number of form fi CVE-2004-23315.5ColdFusion MX 6.1 and 6.1 J2EE allows local users to bypass sandbox security restrictions and obtain sensitive information by using Java ref CVE-2004-23324.3Multiple cross-site scripting (XSS) vulnerabilities in CPAN WWW::Form before 1.13 allow remote attackers to inject arbitrary web script or H