VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 31, 2004· Updated Apr 16, 2026

CVE-2004-1757

CVE-2004-1757

Description

BEA WebLogic Server stores the administrator password in cleartext in config.xml, allowing local users with file access to gain admin privileges.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

BEA WebLogic Server stores the administrator password in cleartext in config.xml, allowing local users with file access to gain admin privileges.

Vulnerability

BEA WebLogic Server and Express 8.1, Service Pack 1 (SP1) and earlier, stores the administrator password used to boot the server in cleartext within the config.xml file. This occurs due to a coding error that causes the password to be automatically written in plain text. The issue affects all platforms for these versions [1].

Exploitation

An attacker requires local access to the file system where config.xml is stored. By reading this file, the attacker can obtain the cleartext administrator password. No authentication or user interaction beyond file read access is needed [1].

Impact

Successful exploitation allows the attacker to acquire the administrator password. The password can then be used to impersonate an administrator, gaining full administrative privileges over the WebLogic Server [1].

Mitigation

BEA Systems released an advisory recommending users upgrade to WebLogic Server and Express 8.1 Service Pack 2 (SP2) to address the issue. No workaround is mentioned in the available references [1].

References
  1. CERT/CC Vulnerability Note VU#350350

AI Insight generated on May 24, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

47
  • Bea/Weblogic Server46 versions
    cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*+ 45 more
    • cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:6.1:sp1:win32:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:6.1:sp2:win32:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:6.1:sp3:win32:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:6.1:sp4:win32:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:6.1:sp5:win32:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:6.1:sp6:win32:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:6.1:*:win32:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:7.0:sp5:win32:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*
    • cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*
  • Oracle Corporation/Weblogic Serverllm-fuzzy
    Range: <=8.1 SP1

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

5

News mentions

0

No linked articles in our index yet.