CVE-2004-1758 json
BEA WebLogic Server and WebLogic Express version 8.1 up to SP2, 7.0 up to SP4, and 6.1 up to SP6 may store the database username and passwo…
published 2004-04-13 22 y ago modified 2026-06-16 4 mo ago also EUVD-2004-1752
- cvss
- 4.6
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 30%
- public exploits
- 0
- none known
Summary
BEA WebLogic Server and WebLogic Express version 8.1 up to SP2, 7.0 up to SP4, and 6.1 up to SP6 may store the database username and password for an untargeted JDBC connection pool in plaintext in config.xml, which allows local users to gain privileges.
Patch / fix
Exploit prediction
0.36% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P |
References
-
dev2dev.bea.com
/resourcelibrary/advisoriesnotifications/BEA04_53.00.jsp
patch, vendor-advisory
-
kb.cert.org
/vuls/id/920238
third-party-advisory, patch, us-government-resource
-
securityfocus.com
/bid/10131
vdb-entry, patch, vendor-advisory
-
securitytracker.com
/id?1009764
vdb-entry
-
osvdb.org
/5297
vdb-entry
-
secunia.com
/advisories/11357
third-party-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/15860
vdb-entry
Sources
- CVE List CVE-2004-1758
- NVD CVE-2004-1758
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.