CVE-2004-0715
Status: ModifiedMedium (5.1)—
The WebLogic Authentication provider for BEA WebLogic Server and WebLogic Express 8.1 through SP2 and 7.0 through SP4 does not properly clear member relationships when a group is deleted, which can cause a new group with the same name to have the members of the old group, which allows group members to gain privileges.
CVSS
- Version: 2.0
- Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
- Base score: 5.1
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 2.31%
- Percentile among all scored CVEs: 83
- Score date: 10/8/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
CWEs
- NVD-CWE-Other
References
- http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_52.01.jsp
- http://secunia.com/advisories/11356
- http://securitytracker.com/id?1009763
- http://www.kb.cert.org/vuls/id/470470
- http://www.osvdb.org/5299
- http://www.securityfocus.com/bid/10130
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15861
- http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_52.01.jsp
- http://secunia.com/advisories/11356
- http://securitytracker.com/id?1009763
- http://www.kb.cert.org/vuls/id/470470
- http://www.osvdb.org/5299
- http://www.securityfocus.com/bid/10130
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15861
Raw JSON (NVD)
Show
{
"id": "CVE-2004-0715",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 5.1,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "HIGH",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 4.9,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": true,
"userInteractionRequired": true
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2004-07-27T04:00:00.000",
"references": [
{
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_52.01.jsp",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/11356",
"source": "cve@mitre.org"
},
{
"url": "http://securitytracker.com/id?1009763",
"source": "cve@mitre.org"
},
{
"url": "http://www.kb.cert.org/vuls/id/470470",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.osvdb.org/5299",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/10130",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15861",
"source": "cve@mitre.org"
},
{
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_52.01.jsp",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/11356",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://securitytracker.com/id?1009763",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.kb.cert.org/vuls/id/470470",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.osvdb.org/5299",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/10130",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15861",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The WebLogic Authentication provider for BEA WebLogic Server and WebLogic Express 8.1 through SP2 and 7.0 through SP4 does not properly clear member relationships when a group is deleted, which can cause a new group with the same name to have the members of the old group, which allows group members to gain privileges."
},
{
"lang": "es",
"value": "El proveedor de Autenticación WebLogic en BEA WebLogic Server y WebLogic Express 8.1 hasta SP2 y 7.0 hasta SP4 no elimina relaciones entre miembros cuando se borra un grupo, lo que puede causar que un nuevo grupo con el mismo nombre tenga miembros del grupo antiguo, lo que permite a miembros del grupo ganar privilegios."
}
],
"lastModified": "2026-06-16T22:06:13.290",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276"
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2"
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1"
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8"
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC"
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A"
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF"
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B"
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A5C59B80-279B-45B3-9CC1-5A263681025B"
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9"
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431"
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D2D05BAB-AB3B-466E-8301-01A41644DE77"
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E"
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525"
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D"
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F"
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58"
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A3DFE048-905E-4890-809D-F6BCEF7F83C9"
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB"
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226"
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB"
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1"
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF"
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D00633D1-4B38-48D9-B5CD-E8D66EA90599"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}