Vulnerabilities > CVE-2004-1758 - Unspecified vulnerability in BEA Weblogic Server 6.1/7.0/8.1

047910
CVSS 4.6 - MEDIUM
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
local
low complexity
bea
NVD
Published: 2004-04-13
Updated: 2017-07-11

Summary

BEA WebLogic Server and WebLogic Express version 8.1 up to SP2, 7.0 up to SP4, and 6.1 up to SP6 may store the database username and password for an untargeted JDBC connection pool in plaintext in config.xml, which allows local users to gain privileges.

Vulnerable Configurations

Part Description Count
Application
Bea
37

References