CVE-2005-4767 : BEA WebLogic Server and WebLogic Express 8.1 SP5 and earlier, and 7.0 SP6 and ea

BEA WebLogic Server and WebLogic Express 8.1 SP5 and earlier, and 7.0 SP6 and earlier, when using username/password authentication, does not lock out a username after the maximum number of invalid login attempts, which makes it easier for remote attackers to guess the password.

Published 2005-12-31 05:00:00

Updated 2008-09-05 20:57:47

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2005-4767

BEA » Weblogic Server » Version: 7.0 Express Edition
cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0
cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP1 Express Edition
cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP2
cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP1
cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP2 Express Edition
cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP3 Express Edition
cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP3 Win32 Edition
cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP3
cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP1 Win32 Edition
cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP2 Win32 Edition
cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP4 Win32 Edition
cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Win32 Edition
cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Express Edition
cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Win32 Edition
cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP3
cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP3 Express Edition
cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP5
cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP1 Win32 Edition
cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP2
cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP4 Express Edition
cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP4 Win32 Edition
cpe:2.3:a:bea:weblogic_server:8.1:sp4:win32:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP5 Express Edition
cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP5 Win32 Edition
cpe:2.3:a:bea:weblogic_server:7.0:sp5:win32:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP2 Express Edition
cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP2 Win32 Edition
cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP4
cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP4 Express Edition
cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP1
cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP1 Express Edition
cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP3 Win32 Edition
cpe:2.3:a:bea:weblogic_server:8.1:sp3:win32:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP4
cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1
cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP6
cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP6 Express Edition
cpe:2.3:a:bea:weblogic_server:7.0:sp6:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP5 Express Edition
cpe:2.3:a:bea:weblogic_server:8.1:sp5:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP5 Win32 Edition
cpe:2.3:a:bea:weblogic_server:8.1:sp5:win32:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP5
cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP6 Win32 Edition
cpe:2.3:a:bea:weblogic_server:7.0:sp6:win32:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2005-4767

EPSS FAQ

1.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 76 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2005-4767

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.1	MEDIUM	AV:N/AC:H/Au:N/C:P/I:P/A:P	4.9	6.4	NIST
Access Vector: Network Access Complexity: High Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

References for CVE-2005-4767

http://dev2dev.bea.com/pub/advisory/178

Patch;Vendor Advisory
http://www.securityfocus.com/bid/17168

Patch
http://dev2dev.bea.com/pub/advisory/161

Patch;Vendor Advisory
http://www.securityfocus.com/bid/15052

Patch

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2005-4767

Products affected by CVE-2005-4767

Exploit prediction scoring system (EPSS) score for CVE-2005-4767

CVSS scores for CVE-2005-4767

References for CVE-2005-4767