Secunia

BEA has issued an update for WebLogic Server and WebLogic Express. This fixes a vulnerability allowing malicious users to perform unauthorised deletion of objects.

Objects of the EJB may be unexported from remote view even if a caller doesn't have sufficient permissions. The problem is that a bean is unexported before the security exception is thrown.

Successful exploitation requires that a site has an application, which calls the "remove()" method of a stateful EJB with a remote view.

Solution
Updates are available.
Further details available in Customer Area

Provided and/or discovered by
Reported by vendor.

Changelog
Further details available in Customer Area

Original Advisory
http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_57.00.jsp

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area