Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2004-1758: WebLogic Server stores DB passwords in readable file

CVE-2004-1758 · published 22 years ago

Summary

Certain older versions of BEA WebLogic Server keep database usernames and passwords in plain text inside the configuration file. This means anyone with local access to the server can read those credentials and potentially access the database. Update to a supported version or reconfigure the server to protect the file and use encrypted credentials.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
bea	weblogic_server	6.1 7.0 8.1 `cpe:2.3:a:bea:weblogic_server:6.1:::::::*`

Original advisory text

BEA WebLogic Server and WebLogic Express version 8.1 up to SP2, 7.0 up to SP4, and 6.1 up to SP6 may store the database username and password for an untargeted JDBC connection pool in plaintext in ...

References

http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_53.00.jsp Patch Vendor Advisory
http://secunia.com/advisories/11357
http://securitytracker.com/id?1009764
http://www.kb.cert.org/vuls/id/920238 Patch Third Party Advisory US Government Resource
http://www.osvdb.org/5297
http://www.securityfocus.com/bid/10131 Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/15860

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

4.6 Medium

Exploitation

<1% chance of attack within 30 days

Timeline

Published13 Apr 2004

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2004-1758 · NVD

Track software like this

Free during beta