Vulnerability Details : CVE-2004-1756

BEA WebLogic Server and WebLogic Express 8.1 SP2 and earlier, and 7.0 SP4 and earlier, when using 2-way SSL with a custom trust manager, may accept a certificate chain even if the trust manager rejects it, which allows remote attackers to spoof other users or servers.

Published 2004-04-13 04:00:00

Updated 2017-07-11 01:31:20

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2004-1756

Probability of exploitation activity in the next 30 days: 1.61%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 86 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2004-1756

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N	10.0	2.9	nvd@nist.gov
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None

References for CVE-2004-1756

http://www.securityfocus.com/bid/10132

Patch;Vendor Advisory
http://securitytracker.com/id?1009765

Patch;Vendor Advisory
http://www.kb.cert.org/vuls/id/566390

Patch;Third Party Advisory;US Government Resource
http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_54.00.jsp

Patch;Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/15862

Products affected by CVE-2004-1756

BEA » Weblogic Server » Version: 7.0 Express Edition
cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP1 Express Edition
cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP2
cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP1
cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP2 Express Edition
cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP3 Express Edition
cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP3
cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP4 Win32 Edition
cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Win32 Edition
cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Express Edition
cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Win32 Edition
cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP1 Win32 Edition
cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP2
cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP2 Express Edition
cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP2 Win32 Edition
cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP4
cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP4 Express Edition
cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP1
cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP1 Express Edition
cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1
cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*
Matching versions