CVE-2005-4756: Bea WebLogic Server

High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days.

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not properly validate derived Principals with multiple PrincipalValidators, which might allow attackers to gain privileges.

Affected products

• Bea WebLogic Server: version 7.0 only; version 8.1 only

Published 2005-12-31. Last modified 2026-06-16.