CVE-2004-2763

MediumCVSS 5.8/10Last modified Jun 16, 2026

Description

The default configuration of Sun ONE/iPlanet Web Server 4.1 SP1 through SP12 and 6.0 SP1 through SP5 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting.

Metrics

CVSS 2.0 5.8/10AV:N/AC:M/Au:N/C:P/I:P/A:N

Weakness enumeration

CWE-16

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archive.cert.uni-stuttgart.de/uniras/2004/02/msg00007.html
http://www.cgisecurity.com/whitehat-mirror/WH-WhitePaper_XST_ebook.pdfExploit
http://www.kb.cert.org/vuls/id/867593US Government Resource
http://archive.cert.uni-stuttgart.de/uniras/2004/02/msg00007.html
http://www.cgisecurity.com/whitehat-mirror/WH-WhitePaper_XST_ebook.pdfExploit
http://www.kb.cert.org/vuls/id/867593US Government Resource

Timeline

Published: Jun 1, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-276410.0Sun SDK and Java Runtime Environment (JRE) 1.4.2 through 1.4.2_04, 1.4.1 through 1.4.1_07, and 1.4.0 through 1.4.0_04 allows untrusted apple CVE-2004-27654.3Cross-site scripting (XSS) vulnerability in Webmail in Sun ONE Messaging Server 6.1 and iPlanet Messaging Server 5.2 before 5.2hf2.02, when CVE-2004-27664.3Webmail in Sun ONE Messaging Server 6.1 and iPlanet Messaging Server 5.2 before 5.2hf2.02 allows remote attackers to obtain unspecified "acc CVE-2004-27674.3NWFTPD.nlm before 5.04.25 in the FTP server in Novell NetWare does not promptly close DS sessions, which allows remote attackers to cause a CVE-2004-27687.2dpkg 1.9.21 does not properly reset the metadata of a file during replacement of the file in a package upgrade, which might allow local user CVE-2004-27694.0Cerberus FTP Server before 4.0.3.0 allows remote authenticated users to list hidden files, even when the "Display hidden files" option is en CVE-2004-27717.5The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary CVE-2004-27769.8go.cgi in GoScript 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) query string or (2) artarch CVE-2004-277710.0GE Healthcare Centricity Image Vault 3.x has a password of (1) gemnet for the administrator account, (2) webadmin for the webadmin administr CVE-2004-27787.1Ebuild in Gentoo may change directory and file permissions depending on the order of installed packages, which allows local users to read or CVE-2004-27797.5id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggeri