CVE-2004-0470

no score yetEPSS 2.7%

BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2, when editing weblogic.xml using WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method, inadvertently removes security-role-assignment tags when weblogic.xml does not have a principal-name tag, which can remove intended access restrictions for the associated web application.

EPSS: 2.7% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
Published: 2004-07-07
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

bea:weblogic_server

References

http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_59.00.jsp
http://secunia.com/advisories/11593
http://securitytracker.com/id?1010128
http://www.kb.cert.org/vuls/id/950070
http://www.osvdb.org/6076

Check your stack JSON