CVE-2004-0713: Medium severity Bea WebLogic Server vulnerability
The remove method in a stateful Enterprise JavaBean (EJB) in BEA WebLogic Server and WebLogic Express version 8.1 through SP2, 7.0 through SP4, and 6.1 through SP6, does not properly check EJB permissions before unexporting a bean, which allows remote authenticated users to remove EJB objects from remote views before the security exception is thrown.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2004-0713?
The severity of CVE-2004-0713 is considered high due to the potential for remote authenticated users to remove EJB objects improperly.
How do I fix CVE-2004-0713?
To fix CVE-2004-0713, apply the latest patches provided by BEA for WebLogic Server versions 8.1, 7.0, and 6.1.
Which versions of WebLogic Server are affected by CVE-2004-0713?
CVE-2004-0713 affects WebLogic Server versions 6.1 through 8.1, with specific service packs also impacted.
What is the impact of CVE-2004-0713?
The impact of CVE-2004-0713 allows remote authenticated users to execute unwanted actions on EJB objects, potentially compromising server integrity.
Is there a workaround for CVE-2004-0713 if I cannot apply the patch?
A potential workaround for CVE-2004-0713 is to restrict access to the EJB methods to only trusted users until a patch can be applied.