CVE-2004-0652

BEA WebLogic Server and WebLogic Express 7.0 through 7.0 Service Pack 4, and 8.1 through 8.1 Service Pack 2, allows attackers to obtain the username and password for booting the server by directly accessing certain internal methods.

Published Bycve@mitre.org

Published DateAug 06, 2004, 04:00

Weakness Type (CWE):NVD-CWE-Other

CVSS Metrics

Base Score

7.2

Vector String

AV:L/AC:L/Au:N/C:C/I:C/A:C

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

COMPLETE

Integrity (I)

COMPLETE

Availability (A)

COMPLETE

References

http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_55.00.jsp
http://secunia.com/advisories/11359
http://securitytracker.com/id?1009766
http://www.kb.cert.org/vuls/id/352110
http://www.osvdb.org/5296
http://www.securityfocus.com/bid/10133
https://exchange.xforce.ibmcloud.com/vulnerabilities/15865

Weakness Type (CWE):NVD-CWE-Other

CVSS Metrics

Base Score

7.2

Vector String

AV:L/AC:L/Au:N/C:C/I:C/A:C

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

COMPLETE

Integrity (I)

COMPLETE

Availability (A)

COMPLETE