CVE-2004-1758

no score yetEPSS 0.4%

BEA WebLogic Server and WebLogic Express version 8.1 up to SP2, 7.0 up to SP4, and 6.1 up to SP6 may store the database username and password for an untargeted JDBC connection pool in plaintext in config.xml, which allows local users to gain privileges.

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-31)
Published: 2004-04-13
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

bea:weblogic_server

References

http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_53.00.jsp
http://secunia.com/advisories/11357
http://securitytracker.com/id?1009764
http://www.kb.cert.org/vuls/id/920238
http://www.osvdb.org/5297

Check your stack JSON