CVE-2004-2696
BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, when using Remote Method Invocation (RMI) over Internet Inter-ORB Protocol (IIOP), does not properly handle when multiple logins for different users coming from the same client, which could…
Does this matter?
Lower severity and a low EPSS score (1.29%). Track it; it rarely justifies an emergency change on its own.
Description
BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, when using Remote Method Invocation (RMI) over Internet Inter-ORB Protocol (IIOP), does not properly handle when multiple logins for different users coming from the same client, which could cause an "unexpected user identity" to be used in an RMI call.
- CVSS 2.0
- 5.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:N
- EPSS
- 1.29% probability · 69th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-255
- Affected
- bea/weblogic server
- Source
- cve@mitre.org
References
- http://dev2dev.bea.com/pub/advisory/59
- http://secunia.com/advisories/11865Vendor Advisory
- http://securitytracker.com/id?1010493
- http://www.osvdb.org/7081
- http://www.securityfocus.com/bid/10545
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16421
- http://dev2dev.bea.com/pub/advisory/59
- http://secunia.com/advisories/11865Vendor Advisory
- http://securitytracker.com/id?1010493
- http://www.osvdb.org/7081
- http://www.securityfocus.com/bid/10545
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16421
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.