Analyst readout for executives and security teams
Plain-English summary
CVE-2004-1755 is a legacy BEA WebLogic issue where a Web Services fat client using mutual TLS could reuse the wrong certificate identity after an initial connection. In affected deployments, a user might be treated as another identity and gain unintended privileges.
Executive priority
Treat this as a targeted legacy risk, not a broad internet emergency. Prioritize if old WebLogic integrations still support sensitive workflows or privileged service access.
Technical view
The issue affects BEA WebLogic Server and Express 7.0 SP4 and earlier Web Services fat clients when two-way SSL is used and multiple certificates connect to the same URL. The client may select an incorrect identity after the first connection, creating an authorization bypass or privilege confusion risk.
Likely exposure
Exposure is likely limited to legacy WebLogic Server or Express 7.0 SP4 and earlier environments using Web Services fat clients, mutual TLS, and multiple client certificates against the same URL.
Exploitation context
The provided sources do not show active exploitation, and CVE data marks KEV as false. Practical risk depends on whether this old WebLogic client pattern still exists in production or trusted internal integrations.
Researcher notes
The core issue is identity confusion in the Web Services fat client under a specific mutual TLS configuration. The source bundle lacks CVSS, CWE, normalized CPEs, and detailed vendor fix text, so exposure validation is the main first step.
Mitigation direction
- Identify any BEA WebLogic Server or Express 7.0 SP4 and earlier deployments.
- Check BEA or Oracle legacy guidance for the vendor-supported correction.
- Prioritize retirement or upgrade of unsupported WebLogic components.
- Review mutual TLS client designs that reuse one URL with multiple certificates.
- Apply compensating access controls if legacy clients cannot be replaced quickly.
Validation and detection
- Inventory WebLogic versions and Web Services fat client usage.
- Confirm whether two-way SSL is enabled for affected integrations.
- Check whether multiple client certificates connect to the same service URL.
- Review authorization logs for identity mismatch or unexpected privilege use.
- Document vendor advisory status and remediation decisions.
Public sources used
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2004-1755 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- VU#858990CVE reference · third-party-advisory, x_refsource_CERT-VN
- weblogic-multiple-connection-gain-access(15826)CVE reference · vdb-entry, x_refsource_XF
- 10725CVE reference · third-party-advisory, x_refsource_SECUNIA
- 9502CVE reference · vdb-entry, x_refsource_BID
- http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_47.00.jspCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.