CVE-2004-0652 json
BEA WebLogic Server and WebLogic Express 7.0 through 7.0 Service Pack 4, and 8.1 through 8.1 Service Pack 2, allows attackers to obtain the…
published 2004-07-13 22 y ago modified 2026-06-16 4 mo ago also EUVD-2004-0651
- cvss
- 7.2
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 33%
- public exploits
- 0
- none known
Summary
BEA WebLogic Server and WebLogic Express 7.0 through 7.0 Service Pack 4, and 8.1 through 8.1 Service Pack 2, allows attackers to obtain the username and password for booting the server by directly accessing certain internal methods.
Patch / fix
- securityfocus.com/bid/10133 advisory
- kb.cert.org/vuls/id/352110 advisory
Exploit prediction
0.39% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
References
-
securityfocus.com
/bid/10133
vdb-entry, patch, vendor-advisory
-
kb.cert.org
/vuls/id/352110
third-party-advisory, patch, us-government-resource
- dev2dev.bea.com /resourcelibrary/advisoriesnotifications/BEA04_55.00.jsp
-
osvdb.org
/5296
vdb-entry
-
securitytracker.com
/id?1009766
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/15865
vdb-entry
-
secunia.com
/advisories/11359
third-party-advisory
Sources
- CVE List CVE-2004-0652
- NVD CVE-2004-0652
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.