CVE-2004-1756: Medium severity Bea WebLogic Server vulnerability
BEA WebLogic Server and WebLogic Express 8.1 SP2 and earlier, and 7.0 SP4 and earlier, when using 2-way SSL with a custom trust manager, may accept a certificate chain even if the trust manager rejects it, which allows remote attackers to spoof other users or servers.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2004-1756?
CVE-2004-1756 is rated as high severity due to its potential for remote exploitation and user impersonation.
How do I fix CVE-2004-1756?
To fix CVE-2004-1756, upgrade to the latest version of BEA WebLogic Server or apply the recommended patches provided by Oracle.
What software is affected by CVE-2004-1756?
CVE-2004-1756 affects BEA WebLogic Server and WebLogic Express versions 7.0 SP4 and earlier, and 8.1 SP2 and earlier.
Can CVE-2004-1756 be exploited remotely?
Yes, CVE-2004-1756 can be exploited remotely, allowing attackers to spoof other users or servers.
What does CVE-2004-1756 involve regarding SSL?
CVE-2004-1756 involves a vulnerability in the handling of 2-way SSL with custom trust managers, allowing certificate chains to be accepted even if rejected.