Description
The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting.
References
- weblogic-trace-xss(14959) vdb-entry
- VU#867593 third-party-advisory
- BEA04-48.01 vendor-advisory
- 9506 vdb-entry
- 10726 third-party-advisory
- 1008866 vdb-entry
- 3726 vdb-entry