VULNERABILITY INTELLIGENCE
CVE-2004-2320
CVSS score5.3 MEDIUM
EPSS probability2.90%
CISA KEVNot currently listed
Published2004-12-31
Last modified2026-06-16
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Description
The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting.
Weakness classification
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Primary references
- cve@mitre.org — Patch, Vendor Advisory
- cve@mitre.org — Vendor Advisory
- cve@mitre.org — Third Party Advisory, US Government Resource
- cve@mitre.org
- cve@mitre.org — Patch
- cve@mitre.org — Patch
- cve@mitre.org
- af854a3a-2127-422b-91ae-364da2661108 — Patch, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, US Government Resource
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108 — Patch