CVE-2004-1758

BEA WebLogic Server and WebLogic Express version 8.1 up to SP2, 7.0 up to SP4, and 6.1 up to SP6 may store the database username and password for an untargeted JDBC connection pool in plaintext in config.xml, which allows local users to gain privileges.

CVSS v2.0 4.6 MEDIUM

4.6^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_53.00.jsp	Patch Vendor Advisory
http://secunia.com/advisories/11357
http://securitytracker.com/id?1009764
http://www.kb.cert.org/vuls/id/920238	Patch Third Party Advisory US Government Resource
http://www.osvdb.org/5297
http://www.securityfocus.com/bid/10131	Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/15860
http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_53.00.jsp	Patch Vendor Advisory
http://secunia.com/advisories/11357
http://securitytracker.com/id?1009764
http://www.kb.cert.org/vuls/id/920238	Patch Third Party Advisory US Government Resource
http://www.osvdb.org/5297
http://www.securityfocus.com/bid/10131	Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/15860

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:bea:weblogic_server:6.1:::::::*
	cpe:2.3:a:bea:weblogic_server:6.1::express:::::
	cpe:2.3:a:bea:weblogic_server:6.1::win32:::::
	cpe:2.3:a:bea:weblogic_server:6.1:sp1::::::
	cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:::::*
	cpe:2.3:a:bea:weblogic_server:6.1:sp1:win32:::::*
	cpe:2.3:a:bea:weblogic_server:6.1:sp2::::::
	cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:::::*
	cpe:2.3:a:bea:weblogic_server:6.1:sp2:win32:::::*
	cpe:2.3:a:bea:weblogic_server:6.1:sp3::::::
	cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:::::*
	cpe:2.3:a:bea:weblogic_server:6.1:sp4::::::
	cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:::::*
	cpe:2.3:a:bea:weblogic_server:6.1:sp5::::::
	cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:::::*
	cpe:2.3:a:bea:weblogic_server:6.1:sp6::::::
	cpe:2.3:a:bea:weblogic_server:7.0:::::::*
	cpe:2.3:a:bea:weblogic_server:7.0::express:::::
	cpe:2.3:a:bea:weblogic_server:7.0::win32:::::
	cpe:2.3:a:bea:weblogic_server:7.0:sp1::::::
	cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:::::*
	cpe:2.3:a:bea:weblogic_server:7.0:sp2::::::
	cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:::::*
	cpe:2.3:a:bea:weblogic_server:7.0:sp3::::::
	cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:::::*
	cpe:2.3:a:bea:weblogic_server:7.0:sp4::::::
	cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:::::*
	cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:::::*
	cpe:2.3:a:bea:weblogic_server:8.1:::::::*
	cpe:2.3:a:bea:weblogic_server:8.1::express:::::
	cpe:2.3:a:bea:weblogic_server:8.1::win32:::::
	cpe:2.3:a:bea:weblogic_server:8.1:sp1::::::
	cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:::::*
	cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:::::*
	cpe:2.3:a:bea:weblogic_server:8.1:sp2::::::
	cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:::::*
	cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:::::*

History

20 Nov 2024, 23:51

Type	Values Removed	Values Added
References	~~() http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_53.00.jsp - Patch, Vendor Advisory~~	() http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_53.00.jsp - Patch, Vendor Advisory
References	~~() http://secunia.com/advisories/11357 -~~	() http://secunia.com/advisories/11357 -
References	~~() http://securitytracker.com/id?1009764 -~~	() http://securitytracker.com/id?1009764 -
References	~~() http://www.kb.cert.org/vuls/id/920238 - Patch, Third Party Advisory, US Government Resource~~	() http://www.kb.cert.org/vuls/id/920238 - Patch, Third Party Advisory, US Government Resource
References	~~() http://www.osvdb.org/5297 -~~	() http://www.osvdb.org/5297 -
References	~~() http://www.securityfocus.com/bid/10131 - Patch, Vendor Advisory~~	() http://www.securityfocus.com/bid/10131 - Patch, Vendor Advisory
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/15860 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/15860 -

Information

Published : 2004-04-13 04:00

Updated : 2025-04-03 01:03

NVD link : CVE-2004-1758

Mitre link : CVE-2004-1758

CVE.ORG link : CVE-2004-1758

JSON object : View

Products Affected

bea

weblogic_server

CWE

NVD-CWE-Other

{"id": "CVE-2004-1758", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2004-04-13T04:00:00.000", "references": [{"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_53.00.jsp", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/11357", "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id?1009764", "source": "cve@mitre.org"}, {"url": "http://www.kb.cert.org/vuls/id/920238", "tags": ["Patch", "Third Party Advisory", "US Government Resource"], "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/5297", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/10131", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15860", "source": "cve@mitre.org"}, {"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_53.00.jsp", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/11357", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://securitytracker.com/id?1009764", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.kb.cert.org/vuls/id/920238", "tags": ["Patch", "Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.osvdb.org/5297", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/10131", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15860", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "BEA WebLogic Server and WebLogic Express version 8.1 up to SP2, 7.0 up to SP4, and 6.1 up to SP6 may store the database username and password for an untargeted JDBC connection pool in plaintext in config.xml, which allows local users to gain privileges."}], "lastModified": "2025-04-03T01:03:51.193", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "05AFBE78-C611-4EA2-8B00-5F8B61696CBE"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:win32:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AC5439C1-D06F-44C6-94F5-2BD8598A506C"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:win32:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E40C38EC-ECA4-4F0C-8468-16191CDB9997"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "71892EC0-E6B1-4214-AC53-06489F711829"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:win32:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C4FD8871-680E-40F9-85AB-417B5195D4BE"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DCED03B6-7565-4F53-8D85-F3391BF66988"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B70F0353-635F-465B-A7E5-AF2D017AB008"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A3DFE048-905E-4890-809D-F6BCEF7F83C9"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF"}, {"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D00633D1-4B38-48D9-B5CD-E8D66EA90599"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}

4.6 /10