CVE-2003-1226: Bea WebLogic Server

Low severity, CVSS 2.1. EPSS: 0.2% chance of exploitation in the next 30 days.

BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores certain secrets concerning password encryption insecurely in config.xml, filerealm.properties, and weblogic-rar.xml, which allows local users to learn those secrets and decrypt passwords.

Affected products

• Bea WebLogic Server: version 7.0 only; version 7.0.0.1 only

Published 2003-12-31. Last modified 2026-06-16.