CVE-2004-0715: Medium severity Bea WebLogic Server vulnerability
The WebLogic Authentication provider for BEA WebLogic Server and WebLogic Express 8.1 through SP2 and 7.0 through SP4 does not properly clear member relationships when a group is deleted, which can cause a new group with the same name to have the members of the old group, which allows group members to gain privileges.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2004-0715?
CVE-2004-0715 has been classified as a medium severity vulnerability, as it can allow unauthorized access to group memberships.
How do I fix CVE-2004-0715?
To fix CVE-2004-0715, upgrade to a fixed version of BEA WebLogic Server that addresses this vulnerability.
What does CVE-2004-0715 affect?
CVE-2004-0715 affects BEA WebLogic Server and WebLogic Express versions 7.0 through SP4 and 8.1 through SP2.
What are the potential consequences of CVE-2004-0715?
The potential consequence of CVE-2004-0715 is that a newly created group can inherit members from a deleted group, leading to unauthorized access.
Is CVE-2004-0715 an authenticated vulnerability?
Yes, CVE-2004-0715 can be exploited by authenticated users, allowing them to gain access to group memberships they should not have.