CVE-2004-2320

The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting.

• CWE-200
• CWE-200

• http://dev2dev.bea.com/pub/advisory/68Patch, Vendor Advisory
• http://secunia.com/advisories/10726Vendor Advisory
• http://www.kb.cert.org/vuls/id/867593Third Party Advisory, US Government Resource
• http://www.osvdb.org/3726
• http://www.securityfocus.com/bid/9506Patch
• http://www.securitytracker.com/alerts/2004/Jan/1008866.htmlPatch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/14959
• http://dev2dev.bea.com/pub/advisory/68Patch, Vendor Advisory
• http://secunia.com/advisories/10726Vendor Advisory
• http://www.kb.cert.org/vuls/id/867593Third Party Advisory, US Government Resource
• http://www.osvdb.org/3726
• http://www.securityfocus.com/bid/9506Patch
• http://www.securitytracker.com/alerts/2004/Jan/1008866.htmlPatch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/14959

Published

Dec 31, 2004

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2004-2314The Telnet listener for Novell iChain Server before 2.2 Fiel…
• CVE-2004-2315Mbedthis AppWeb HTTP server before 1.0.2 allows remote attac…
• CVE-2004-2316Mbedthis AppWeb HTTP server before 1.0.2 allows remote attac…
• CVE-2004-2317Information leak in Mbedthis AppWeb HTTP server 1.0 through …
• CVE-2004-2318The administrative interface (surgeftpmgr.cgi) for SurgeFTP …
• CVE-2004-2319IBM Informix Dynamic Server (IDS) before 9.40.xC3 allows loc…
• CVE-2004-2321BEA WebLogic Server and Express 8.1 SP1 and earlier allows l…
• CVE-2004-2322SQL injection vulnerability in the (1) announce and (2) note…
• CVE-2004-2323DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d…
• CVE-2004-2324SQL injection vulnerability in DotNetNuke (formerly IBuySpy …
• CVE-2004-2325Cross-site scripting (XSS) vulnerability in EditModule.aspx …
• CVE-2004-2326SQL injection vulnerability in IP3 Networks NetAccess Applia…