VulnerabilityModified
CVE-2004-0471
BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2 does not enforce site restrictions for starting and stopping servers for users in the Admin and Operator security roles, which allows unauthorized users to cause a denial of…
LOW 2.1EPSS 0.40%
Does this matter?
Lower severity and a low EPSS score (0.40%). Track it; it rarely justifies an emergency change on its own.
Description
BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2 does not enforce site restrictions for starting and stopping servers for users in the Admin and Operator security roles, which allows unauthorized users to cause a denial of service (service shutdown).
- CVSS 2.0
- 2.1 LOWAV:L/AC:L/Au:N/C:N/I:N/A:P
- EPSS
- 0.40% probability · 34th percentile
- CISA KEV
- Not listed
- Affected
- bea/weblogic server
- Source
- cve@mitre.org
References
- http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_60.00.jspPatch, Vendor Advisory
- http://secunia.com/advisories/11594
- http://securitytracker.com/id?1010129
- http://www.osvdb.org/6077
- http://www.securityfocus.com/bid/10327
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16121
- http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_60.00.jspPatch, Vendor Advisory
- http://secunia.com/advisories/11594
- http://securitytracker.com/id?1010129
- http://www.osvdb.org/6077
- http://www.securityfocus.com/bid/10327
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16121
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.