Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2004-2320: BEA WebLogic Server allows HTTP TRACE, enabling data theft

CVE-2004-2320 · published 21 years ago

Summary

By default, BEA WebLogic Server accepts HTTP TRACE requests. This can be abused together with cross‑site scripting flaws to reveal user data through cross‑site tracing attacks. Disable the TRACE method in the server configuration or apply the vendor’s patch to stop the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
bea	weblogic_server	5.1 6.1 7.0 8.1 `cpe:2.3:a:bea:weblogic_server:5.1::express:::::`

Original advisory text

The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting.

References

http://dev2dev.bea.com/pub/advisory/68 Patch Vendor Advisory
http://secunia.com/advisories/10726 Vendor Advisory
http://www.kb.cert.org/vuls/id/867593 Third Party Advisory US Government Resource
http://www.osvdb.org/3726
http://www.securityfocus.com/bid/9506 Patch
http://www.securitytracker.com/alerts/2004/Jan/1008866.html Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/14959

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

5.3 Medium

Exploitation

3% chance of attack within 30 days

Type

CWE-200Information Exposure

Timeline

Published31 Dec 2004

Updated22 Oct 2026

First seen29 Sep 2026

Sources

CVE-2004-2320 · NVD

Track software like this

Free during beta