ID CVE-2004-2320
Summary The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting.
References
Vulnerable Configurations
  • cpe:2.3:a:bea:weblogic_server:5.1:-:express
    cpe:2.3:a:bea:weblogic_server:5.1:-:express
  • cpe:2.3:a:bea:weblogic_server:5.1:-:win32
    cpe:2.3:a:bea:weblogic_server:5.1:-:win32
  • BEA Systems WebLogic Server 5.1 SP1
    cpe:2.3:a:bea:weblogic_server:5.1:sp1
  • BEA Systems WebLogic Express 5.1 SP1
    cpe:2.3:a:bea:weblogic_server:5.1:sp1:express
  • BEA Systems WebLogic Server 5.1 SP1 Win32
    cpe:2.3:a:bea:weblogic_server:5.1:sp1:win32
  • BEA Systems WebLogic Server 5.1 SP10
    cpe:2.3:a:bea:weblogic_server:5.1:sp10
  • BEA Systems WebLogic Express 5.1 SP10
    cpe:2.3:a:bea:weblogic_server:5.1:sp10:express
  • BEA Systems WebLogic Server 5.1 SP10 Win32
    cpe:2.3:a:bea:weblogic_server:5.1:sp10:win32
  • BEA Systems WebLogic Server 5.1 SP11
    cpe:2.3:a:bea:weblogic_server:5.1:sp11
  • BEA Systems WebLogic Express 5.1 SP11
    cpe:2.3:a:bea:weblogic_server:5.1:sp11:express
  • BEA Systems WebLogic Server 5.1 SP11 Win32
    cpe:2.3:a:bea:weblogic_server:5.1:sp11:win32
  • BEA Systems WebLogic Server 5.1 SP12
    cpe:2.3:a:bea:weblogic_server:5.1:sp12
  • BEA Systems WebLogic Express 5.1 SP12
    cpe:2.3:a:bea:weblogic_server:5.1:sp12:express
  • BEA Systems WebLogic Server 5.1 SP12 Win32
    cpe:2.3:a:bea:weblogic_server:5.1:sp12:win32
  • BEA Systems WebLogic Server 5.1 SP13
    cpe:2.3:a:bea:weblogic_server:5.1:sp13
  • BEA Systems WebLogic Express 5.1 SP13
    cpe:2.3:a:bea:weblogic_server:5.1:sp13:express
  • BEA Systems WebLogic Server 5.1 SP13 Win32
    cpe:2.3:a:bea:weblogic_server:5.1:sp13:win32
  • BEA Systems WebLogic Server 5.1 SP2
    cpe:2.3:a:bea:weblogic_server:5.1:sp2
  • BEA Systems WebLogic Express 5.1 SP2
    cpe:2.3:a:bea:weblogic_server:5.1:sp2:express
  • BEA Systems WebLogic Server 5.1 SP2 Win32
    cpe:2.3:a:bea:weblogic_server:5.1:sp2:win32
  • BEA Systems WebLogic Server 5.1 SP3
    cpe:2.3:a:bea:weblogic_server:5.1:sp3
  • BEA Systems WebLogic Express 5.1 SP3
    cpe:2.3:a:bea:weblogic_server:5.1:sp3:express
  • BEA Systems WebLogic Server 5.1 SP3 Win32
    cpe:2.3:a:bea:weblogic_server:5.1:sp3:win32
  • BEA Systems WebLogic Server 5.1 SP4
    cpe:2.3:a:bea:weblogic_server:5.1:sp4
  • BEA Systems WebLogic Express 5.1 SP4
    cpe:2.3:a:bea:weblogic_server:5.1:sp4:express
  • BEA Systems WebLogic Server 5.1 SP4 Win32
    cpe:2.3:a:bea:weblogic_server:5.1:sp4:win32
  • BEA Systems WebLogic Server 5.1 SP5
    cpe:2.3:a:bea:weblogic_server:5.1:sp5
  • BEA Systems WebLogic Express 5.1 SP5
    cpe:2.3:a:bea:weblogic_server:5.1:sp5:express
  • BEA Systems WebLogic Server 5.1 SP5 Win32
    cpe:2.3:a:bea:weblogic_server:5.1:sp5:win32
  • BEA Systems WebLogic Server 5.1 SP6
    cpe:2.3:a:bea:weblogic_server:5.1:sp6
  • BEA Systems WebLogic Express 5.1 SP6
    cpe:2.3:a:bea:weblogic_server:5.1:sp6:express
  • BEA Systems WebLogic Server 5.1 SP6 Win32
    cpe:2.3:a:bea:weblogic_server:5.1:sp6:win32
  • BEA Systems WebLogic Server 5.1 SP7
    cpe:2.3:a:bea:weblogic_server:5.1:sp7
  • BEA Systems WebLogic Express 5.1 SP7
    cpe:2.3:a:bea:weblogic_server:5.1:sp7:express
  • BEA Systems WebLogic Server 5.1 SP7 Win32
    cpe:2.3:a:bea:weblogic_server:5.1:sp7:win32
  • BEA Systems WebLogic Server 5.1 SP8
    cpe:2.3:a:bea:weblogic_server:5.1:sp8
  • BEA Systems WebLogic Express 5.1 SP8
    cpe:2.3:a:bea:weblogic_server:5.1:sp8:express
  • BEA Systems WebLogic Server 5.1 SP8 Win32
    cpe:2.3:a:bea:weblogic_server:5.1:sp8:win32
  • BEA Systems WebLogic Server 5.1 SP9
    cpe:2.3:a:bea:weblogic_server:5.1:sp9
  • BEA Systems WebLogic Express 5.1 SP9
    cpe:2.3:a:bea:weblogic_server:5.1:sp9:express
  • BEA Systems WebLogic Server 5.1 SP9 Win32
    cpe:2.3:a:bea:weblogic_server:5.1:sp9:win32
  • BEA Systems WebLogic Server 6.1
    cpe:2.3:a:bea:weblogic_server:6.1
  • cpe:2.3:a:bea:weblogic_server:6.1:-:express
    cpe:2.3:a:bea:weblogic_server:6.1:-:express
  • cpe:2.3:a:bea:weblogic_server:6.1:-:win32
    cpe:2.3:a:bea:weblogic_server:6.1:-:win32
  • BEA Systems WebLogic Server 6.1 SP1
    cpe:2.3:a:bea:weblogic_server:6.1:sp1
  • BEA Systems WebLogic Express 6.1 SP1
    cpe:2.3:a:bea:weblogic_server:6.1:sp1:express
  • BEA Systems WebLogic Server 6.1 SP1 Win32
    cpe:2.3:a:bea:weblogic_server:6.1:sp1:win32
  • BEA Systems WebLogic Server 6.1 SP2
    cpe:2.3:a:bea:weblogic_server:6.1:sp2
  • BEA Systems WebLogic Express 6.1 SP2
    cpe:2.3:a:bea:weblogic_server:6.1:sp2:express
  • BEA Systems WebLogic Server 6.1 SP2 Win32
    cpe:2.3:a:bea:weblogic_server:6.1:sp2:win32
  • BEA Systems WebLogic Server 6.1 SP3
    cpe:2.3:a:bea:weblogic_server:6.1:sp3
  • BEA Systems WebLogic Express 6.1 SP3
    cpe:2.3:a:bea:weblogic_server:6.1:sp3:express
  • BEA Systems WebLogic Server 6.1 SP3 Win32
    cpe:2.3:a:bea:weblogic_server:6.1:sp3:win32
  • BEA Systems WebLogic Server 6.1 SP4
    cpe:2.3:a:bea:weblogic_server:6.1:sp4
  • BEA Systems WebLogic Express 6.1 SP4
    cpe:2.3:a:bea:weblogic_server:6.1:sp4:express
  • BEA Systems WebLogic Server 6.1 SP4 Win32
    cpe:2.3:a:bea:weblogic_server:6.1:sp4:win32
  • BEA Systems WebLogic Server 6.1 SP5
    cpe:2.3:a:bea:weblogic_server:6.1:sp5
  • BEA Systems WebLogic Express 6.1 SP5
    cpe:2.3:a:bea:weblogic_server:6.1:sp5:express
  • BEA Systems WebLogic Server 6.1 SP5 Win32
    cpe:2.3:a:bea:weblogic_server:6.1:sp5:win32
  • BEA Systems WebLogic Server 6.1 SP6
    cpe:2.3:a:bea:weblogic_server:6.1:sp6
  • BEA Systems WebLogic Server 6.1 SP6 Win32
    cpe:2.3:a:bea:weblogic_server:6.1:sp6:win32
  • BEA Systems WebLogic Server 7.0
    cpe:2.3:a:bea:weblogic_server:7.0
  • cpe:2.3:a:bea:weblogic_server:7.0:-:express
    cpe:2.3:a:bea:weblogic_server:7.0:-:express
  • cpe:2.3:a:bea:weblogic_server:7.0:-:win32
    cpe:2.3:a:bea:weblogic_server:7.0:-:win32
  • cpe:2.3:a:bea:weblogic_server:7.0:sp1
    cpe:2.3:a:bea:weblogic_server:7.0:sp1
  • cpe:2.3:a:bea:weblogic_server:7.0:sp1:express
    cpe:2.3:a:bea:weblogic_server:7.0:sp1:express
  • cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32
    cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32
  • cpe:2.3:a:bea:weblogic_server:7.0:sp2
    cpe:2.3:a:bea:weblogic_server:7.0:sp2
  • cpe:2.3:a:bea:weblogic_server:7.0:sp2:express
    cpe:2.3:a:bea:weblogic_server:7.0:sp2:express
  • cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32
    cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32
  • cpe:2.3:a:bea:weblogic_server:7.0:sp3
    cpe:2.3:a:bea:weblogic_server:7.0:sp3
  • cpe:2.3:a:bea:weblogic_server:7.0:sp3:express
    cpe:2.3:a:bea:weblogic_server:7.0:sp3:express
  • cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32
    cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32
  • cpe:2.3:a:bea:weblogic_server:7.0:sp4
    cpe:2.3:a:bea:weblogic_server:7.0:sp4
  • cpe:2.3:a:bea:weblogic_server:7.0:sp4:express
    cpe:2.3:a:bea:weblogic_server:7.0:sp4:express
  • cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32
    cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32
  • BEA Systems WebLogic Server 8.1
    cpe:2.3:a:bea:weblogic_server:8.1
  • cpe:2.3:a:bea:weblogic_server:8.1:-:express
    cpe:2.3:a:bea:weblogic_server:8.1:-:express
  • cpe:2.3:a:bea:weblogic_server:8.1:-:win32
    cpe:2.3:a:bea:weblogic_server:8.1:-:win32
  • BEA Systems WebLogic Server 8.1 SP1
    cpe:2.3:a:bea:weblogic_server:8.1:sp1
  • BEA Systems WebLogic Express 8.1 SP1
    cpe:2.3:a:bea:weblogic_server:8.1:sp1:express
  • BEA Systems WebLogic Server 8.1 SP1 Win32
    cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32
  • BEA Systems WebLogic Server 8.1 SP2
    cpe:2.3:a:bea:weblogic_server:8.1:sp2
  • BEA Systems WebLogic Express 8.1 SP2
    cpe:2.3:a:bea:weblogic_server:8.1:sp2:express
  • BEA Systems WebLogic Server 8.1 SP2 Win32
    cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32
CVSS
Base: 5.8 (as of 18-08-2005 - 09:38)
Impact:
Exploitability:
CWE CWE-200
CAPEC
  • Subverting Environment Variable Values
    The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.
  • Footprinting
    An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
  • Exploiting Trust in Client (aka Make the Client Invisible)
    An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
  • Browser Fingerprinting
    An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
  • Session Credential Falsification through Prediction
    This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.
  • Reusing Session IDs (aka Session Replay)
    This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Another name for this type of attack is Session Replay.
  • Using Slashes in Alternate Encoding
    This attack targets the encoding of the Slash characters. An attacker would try to exploit common filtering problems related to the use of the slashes characters to gain access to resources on the target host. Directory-driven systems, such as file systems and databases, typically use the slash character to indicate traversal between directories or other container components. For murky historical reasons, PCs (and, as a result, Microsoft OSs) choose to use a backslash, whereas the UNIX world typically makes use of the forward slash. The schizophrenic result is that many MS-based systems are required to understand both forms of the slash. This gives the attacker many opportunities to discover and abuse a number of common filtering problems. The goal of this pattern is to discover server software that only applies filters to one version, but not the other.
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL NONE
nessus via4
  • NASL family CGI abuses
    NASL id WEBLOGIC_MULTIPLE_VULNS.NASL
    description According to its banner, the remote web server is BEA WebLogic version 8.1 SP2 or older. There are multiple vulnerabilities in such versions that may allow unauthorized access on the remote host or to get the content of the remote JSP scripts.
    last seen 2019-01-16
    modified 2018-11-15
    plugin id 14722
    published 2004-09-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=14722
    title WebLogic < 8.1 SP3 Multiple Vulnerabilities
  • NASL family Web Servers
    NASL id HTTP_TRACE.NASL
    description This web server is reachable through a reverse HTTP proxy.
    last seen 2018-09-02
    modified 2018-08-10
    plugin id 11040
    published 2002-07-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=11040
    title HTTP Reverse Proxy Detection
  • NASL family Web Servers
    NASL id XST_HTTP_TRACE.NASL
    description The remote web server supports the TRACE and/or TRACK methods. TRACE and TRACK are HTTP methods that are used to debug web server connections.
    last seen 2019-01-16
    modified 2018-11-26
    plugin id 11213
    published 2003-01-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=11213
    title HTTP TRACE / TRACK Methods Allowed
refmap via4
bea BEA04-48.01
bid 9506
cert-vn VU#867593
osvdb 3726
sectrack 1008866
secunia 10726
xf weblogic-trace-xss(14959)
statements via4
contributor Joshua Bressers
lastmodified 2008-03-05
organization Red Hat
statement The Apache Software Foundation do not treat this as a security issue. A configuration change can be made to disable the ability to respond to HTTP TRACE requests if required. For more information please see: http://www.apacheweek.com/issues/03-01-24#news
Last major update 08-01-2009 - 00:00
Published 31-12-2004 - 00:00
Last modified 10-07-2017 - 21:31
Back to Top