CVE-2006-0419 : BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through S

BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6 allows anonymous binds to the embedded LDAP server, which allows remote attackers to read user entries or cause a denial of service (unspecified) via a large number of connections.

Published 2006-01-25 23:07:00

Updated 2008-09-05 20:59:13

Source MITRE

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2006-0419

BEA » Weblogic Server » Version: 7.0 Update SP1 Express Edition
cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP2
cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP1
cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP2 Express Edition
cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP3 Express Edition
cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP3
cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP3
cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP3 Express Edition
cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP5
cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP2
cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP4 Express Edition
cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP5 Express Edition
cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP2 Express Edition
cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP4
cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP4 Express Edition
cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP1
cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP1 Express Edition
cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP4
cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP6
cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 7.0 Update SP6 Express Edition
cpe:2.3:a:bea:weblogic_server:7.0:sp6:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP5 Express Edition
cpe:2.3:a:bea:weblogic_server:8.1:sp5:express:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 8.1 Update SP5
cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 9.0
cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*
Matching versions
BEA » Weblogic Server » Version: 9.0 Express Edition
cpe:2.3:a:bea:weblogic_server:9.0:*:express:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2006-0419

EPSS FAQ

0.49%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 76 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2006-0419

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.4	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:P	10.0	4.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: Partial

References for CVE-2006-0419

http://securitytracker.com/id?1015528

Patch

CVEs referencing this url
http://dev2dev.bea.com/pub/advisory/163

Exploit;Vendor Advisory

Jump to

Vulnerability Details : CVE-2006-0419

Products affected by CVE-2006-0419

Exploit prediction scoring system (EPSS) score for CVE-2006-0419

CVSS scores for CVE-2006-0419

References for CVE-2006-0419