CVE-2004-1758

CVE-2004-1758 describes a vulnerability in BEA WebLogic Server and WebLogic Express versions 8.1 (up to SP2), 7.0 (up to SP4), and 6.1 (up to SP6) where database credentials for untargeted JDBC connection pools are stored in plaintext within the config.xml file. This local vulnerability (AV:L) has low attack complexity (AC:L) and allows an unauthenticated attacker (Au:N) to gain privileges by accessing sensitive information (C:P), modifying data (I:P), and impacting availability (A:P), resulting in a CVSS score of 4.6. There is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this decade-old vulnerability.