CVE-2004-2763 | BDVDB-2026-36780 Detail

Description#

The default configuration of Sun ONE/iPlanet Web Server 4.1 SP1 through SP12 and 6.0 SP1 through SP5 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://www.kb.cert.org/vuls/id/867593
http://archive.cert.uni-stuttgart.de/uniras/2004/02/msg00007.html
http://www.cgisecurity.com/whitehat-mirror/WH-WhitePaper_XST_ebook.pdf

Exploit#

No public exploit known

History#

Version 12009-06-01Record published in the CVE List.
Version 22024-09-17Most recent update recorded in the CVE List.