Description
BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2, when editing weblogic.xml using WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method, inadvertently removes security-role-assignment tags when weblogic.xml does not have a principal-name tag, which can remove intended access restrictions for the associated web application.
References
- 11593 third-party-advisory
- weblogic-application-unauth-access(16123) vdb-entry
- http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_59.00.jsp
- 1010128 vdb-entry
- 6076 vdb-entry
- VU#950070 third-party-advisory
- 10328 vdb-entry