The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting.
2004-12-31T05:00:00.000
2025-04-03T01:03:51.193
Deferred
CVSSv2: 5.8 (MEDIUM)
AV:N/AC:M/Au:N/C:P/I:P/A:N
8.6
4.9
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 5.1 | Yes |
| Application | bea | weblogic_server | 6.1 | Yes |
| Application | bea | weblogic_server | 6.1 | Yes |
| Application | bea | weblogic_server | 6.1 | Yes |
| Application | bea | weblogic_server | 6.1 | Yes |
| Application | bea | weblogic_server | 6.1 | Yes |
| Application | bea | weblogic_server | 6.1 | Yes |
| Application | bea | weblogic_server | 6.1 | Yes |
| Application | bea | weblogic_server | 6.1 | Yes |
| Application | bea | weblogic_server | 6.1 | Yes |
| Application | bea | weblogic_server | 6.1 | Yes |
| Application | bea | weblogic_server | 6.1 | Yes |
| Application | bea | weblogic_server | 6.1 | Yes |
| Application | bea | weblogic_server | 6.1 | Yes |
| Application | bea | weblogic_server | 6.1 | Yes |
| Application | bea | weblogic_server | 6.1 | Yes |
| Application | bea | weblogic_server | 6.1 | Yes |
| Application | bea | weblogic_server | 6.1 | Yes |
| Application | bea | weblogic_server | 6.1 | Yes |
| Application | bea | weblogic_server | 6.1 | Yes |
| Application | bea | weblogic_server | 6.1 | Yes |
| Application | bea | weblogic_server | 7.0 | Yes |
| Application | bea | weblogic_server | 7.0 | Yes |
| Application | bea | weblogic_server | 7.0 | Yes |
| Application | bea | weblogic_server | 7.0 | Yes |
| Application | bea | weblogic_server | 7.0 | Yes |
| Application | bea | weblogic_server | 7.0 | Yes |
| Application | bea | weblogic_server | 7.0 | Yes |
| Application | bea | weblogic_server | 7.0 | Yes |
| Application | bea | weblogic_server | 7.0 | Yes |
| Application | bea | weblogic_server | 7.0 | Yes |
| Application | bea | weblogic_server | 7.0 | Yes |
| Application | bea | weblogic_server | 7.0 | Yes |
| Application | bea | weblogic_server | 7.0 | Yes |
| Application | bea | weblogic_server | 7.0 | Yes |
| Application | bea | weblogic_server | 7.0 | Yes |
| Application | bea | weblogic_server | 8.1 | Yes |
| Application | bea | weblogic_server | 8.1 | Yes |
| Application | bea | weblogic_server | 8.1 | Yes |
| Application | bea | weblogic_server | 8.1 | Yes |
| Application | bea | weblogic_server | 8.1 | Yes |
| Application | bea | weblogic_server | 8.1 | Yes |
| Application | bea | weblogic_server | 8.1 | Yes |
| Application | bea | weblogic_server | 8.1 | Yes |
| Application | bea | weblogic_server | 8.1 | Yes |