Vulnerabilities > CVE-2004-0470 - Unspecified vulnerability in BEA Weblogic Server 7.0/8.1

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
bea
NVD
Published: 2004-07-07
Updated: 2017-07-11

Summary

BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2, when editing weblogic.xml using WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method, inadvertently removes security-role-assignment tags when weblogic.xml does not have a principal-name tag, which can remove intended access restrictions for the associated web application.

Vulnerable Configurations

Part Description Count
Application
Bea
4

References