vulnwire
7.5high

CVE-2004-1755

The Web Services fat client for BEA WebLogic Server and Express 7.0 SP4 and earlier, when using 2-way SSL and multiple certificates to conn…

Published 21 y ago · modified 4 mo ago · JSON

CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.5%
percentile 74%
Public exploits
0
none known

The Web Services fat client for BEA WebLogic Server and Express 7.0 SP4 and earlier, when using 2-way SSL and multiple certificates to connect to the same URL, may use the incorrect identity after the first connection, which could allow users to gain privileges.

Exploit prediction (EPSS)

1.47% probability of exploitation in the next 30 days, higher than 74% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

References

  • kb.cert.org /vuls/id/858990 · third-party-advisory, x_refsource_CERT-VN, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/15826 · vdb-entry, x_refsource_XF, x_transferred
  • secunia.com /advisories/10725 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securityfocus.com /bid/9502 · vdb-entry, x_refsource_BID, x_transferred
  • dev2dev.bea.com /resourcelibrary/advisoriesnotifications/BEA04_47.00.jsp · x_refsource_CONFIRM, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.