PT-2005-5427 · Bea · Bea Weblogic Server+1

Published 2005-12-31 · Updated 2008-09-05 · CVE-2005-4764

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server and WebLogic Express versions 7.0, 8.1, 9.0

Description The issue allows remote attackers who know or guess the admin account name to cause a denial of service by blocking admin logins, as the server locks out the admin user account after multiple incorrect password guesses.

Recommendations For versions 7.0, 8.1, 9.0, consider implementing a workaround to limit the number of incorrect login attempts or temporarily restrict access to the admin login functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2005-4764

Affected Products

Bea Weblogic Server

Weblogic Express

References · 5

• http://secunia.com/advisories/17138 · Vendor Advisory
• http://securityfocus.com/bid/15052 · Patch
• http://dev2dev.bea.com/pub/advisory/155 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-4764 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4764 · Note