CVE-2005-4752

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, might allow local users to gain privileges by using the run-as deployment descriptor element to change the privileges of a web application or EJB from the Deployer security role to the Admin security role.

Score

CVSS 2.0 4.6 Medium

Status

Modified - cve@mitre.org

Published

2005-12-31

Last modified

2024-09-16

Affected products

• Weblogic Server (Bea)

References

• http://dev2dev.bea.com/pub/advisory/142
• http://secunia.com/advisories/17138
• http://www.securityfocus.com/bid/15052