Vulnerability in Bea Weblogic Server

CVE-2005-4752

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, might allow local users to gain privileges by using the run-as deployment descriptor element to change the privileges of a web application or EJB from the Deployer security role to the Admin security role.

EPSS: 0.003 (27.5th percentile) — read the EPSS interpretation.

Affected products

Bea Weblogic_server — versions 7.0, 8.1
N/a — versions n/a

References

cve@mitre.org (Third Party Advisory, vdb-entry, x_refsource_BID, Vendor Advisory)
cve@mitre.org (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
cve@mitre.org (vendor-advisory, x_refsource_BEA, Patch, Vendor Advisory)