CVE-2004-0713

Severity: medium (CVSS 6.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2004-07-27 · updated 2026-06-16

Description

The remove method in a stateful Enterprise JavaBean (EJB) in BEA WebLogic Server and WebLogic Express version 8.1 through SP2, 7.0 through SP4, and 6.1 through SP6, does not properly check EJB permissions before unexporting a bean, which allows remote authenticated users to remove EJB objects from remote views before the security exception is thrown.

Affected products

Bea Weblogic Server: 6.1, 6.1-sp1, 6.1-sp2, 6.1-sp3, 6.1-sp4, 6.1-sp5 (+9)

References

http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_57.00.jsp
http://www.kb.cert.org/vuls/id/658878
http://www.securityfocus.com/bid/10185
https://exchange.xforce.ibmcloud.com/vulnerabilities/15928
http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_57.00.jsp
http://www.kb.cert.org/vuls/id/658878
http://www.securityfocus.com/bid/10185
https://exchange.xforce.ibmcloud.com/vulnerabilities/15928

Get alerted when CVE-2004-0713 or the next vulnerability affects your stack