Vulnerability Details : CVE-2004-0715

The WebLogic Authentication provider for BEA WebLogic Server and WebLogic Express 8.1 through SP2 and 7.0 through SP4 does not properly clear member relationships when a group is deleted, which can cause a new group with the same name to have the members of the old group, which allows group members to gain privileges.

Published 2004-07-27 04:00:00

Updated 2017-07-11 01:30:24

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2004-0715

Probability of exploitation activity in the next 30 days: 0.39%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 70 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2004-0715

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
5.1	MEDIUM	AV:N/AC:H/Au:N/C:P/I:P/A:P	4.9	6.4	nvd@nist.gov
Access Vector: Network Access Complexity: High Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

References for CVE-2004-0715

http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_52.01.jsp
http://www.kb.cert.org/vuls/id/470470

Third Party Advisory;US Government Resource
http://securitytracker.com/id?1009763
https://exchange.xforce.ibmcloud.com/vulnerabilities/15861
http://www.securityfocus.com/bid/10130

Patch;Vendor Advisory

Products affected by CVE-2004-0715

BEA » Weblogic Server » Version: 7.0 Express Edition
cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0
cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP1 Express Edition
cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP2
cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP1
cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP2 Express Edition
cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP3 Express Edition
cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP3 Win32 Edition
cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP3
cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP1 Win32 Edition
cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP2 Win32 Edition
cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP4 Win32 Edition
cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Win32 Edition
cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Express Edition
cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Win32 Edition
cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP1 Win32 Edition
cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP2
cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP2 Express Edition
cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP2 Win32 Edition
cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP4
cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP4 Express Edition
cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP1
cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP1 Express Edition
cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1
cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*
Matching versions