CVE-2004-1755: High severity Bea WebLogic Server vulnerability
Published Dec 31, 2004
·Updated
The Web Services fat client for BEA WebLogic Server and Express 7.0 SP4 and earlier, when using 2-way SSL and multiple certificates to connect to the same URL, may use the incorrect identity after the first connection, which could allow users to gain privileges.
Affected Software
30 affected components
Bea WebLogic Server=7.0-sp2
Bea WebLogic Server=7.0-sp4
Bea WebLogic Server=7.0
Bea WebLogic Server=7.0-sp3
Bea WebLogic Server=7.0-sp2
Bea WebLogic Server=7.0-sp3
Bea WebLogic Server=7.0-sp2
Bea WebLogic Server=7.0-sp3
Bea WebLogic Server=7.0-sp1
Bea WebLogic Server=7.0-sp1
Bea WebLogic Server=7.0-sp4
Bea WebLogic Server=7.0-sp1
Bea WebLogic Server=7.0
Bea WebLogic Server=7.0
Bea WebLogic Server=7.0-sp4
Bea WebLogic Server=7.0
Bea WebLogic Server=7.0
Bea WebLogic Server=7.0
Bea WebLogic Server=7.0-sp1
Bea WebLogic Server=7.0-sp1
Bea WebLogic Server=7.0-sp1
Bea WebLogic Server=7.0-sp2
Bea WebLogic Server=7.0-sp2
Bea WebLogic Server=7.0-sp2
Bea WebLogic Server=7.0-sp3
Bea WebLogic Server=7.0-sp3
Bea WebLogic Server=7.0-sp3
Bea WebLogic Server=7.0-sp4
Bea WebLogic Server=7.0-sp4
Bea WebLogic Server=7.0-sp4
Remediation
Patch Available
Patch Available
Event History
Dec 31, 2004
CVE Published
05:00 AM
Mar 10, 2005
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-1755?
CVE-2004-1755 is classified as a critical vulnerability that can lead to privilege escalation.
2
How do I fix CVE-2004-1755?
To fix CVE-2004-1755, you should upgrade to a patched version of Oracle WebLogic Server beyond version 7.0 SP4.
3
What versions of WebLogic Server are affected by CVE-2004-1755?
CVE-2004-1755 affects BEA WebLogic Server versions 7.0 SP1 through 7.0 SP4.
4
Does CVE-2004-1755 affect both standard and Express versions of WebLogic Server?
Yes, CVE-2004-1755 affects both the standard and Express versions of BEA WebLogic Server 7.0.
5
What type of attack does CVE-2004-1755 facilitate?
CVE-2004-1755 facilitates privilege escalation due to incorrect identity usage in SSL connections.