Vulnerability CVE-2005-4751 - CERT Civis.Net

Vulnerability Name:

CVE-2005-4751 (CCN-21984)

Assigned:

2005-08-24

Published:

2005-08-24

Updated:

2018-09-27

Summary:

Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and WebLogic Express 9.0, 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier allow remote attackers to inject arbitrary web script or HTML and gain administrative privileges via unknown attack vectors.

CVSS v3 Severity:

5.6 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

5.1 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): High Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: CCN
Type: BugTraq Mailing List: Wed Aug 24 2005 - 06:25:06 CDT
Cross-site scripting vulnerability in BEA WebLogic administration console

Source: MITRE
Type: CNA
CVE-2005-4751

Source: BEA
Type: Patch, Vendor Advisory
BEA05-80.02

Source: CCN
Type: SA17138
BEA WebLogic 24 Vulnerabilities and Security Issues

Source: SECUNIA
Type: Third Party Advisory
17138

Source: CCN
Type: OSVDB ID: 20093
BEA WebLogic Multiple Unspecified XSS

Source: BID
Type: Third Party Advisory, VDB Entry
15052

Source: CCN
Type: BID-15052
BEA WebLogic Server and WebLogic Express Multiple Vulnerabilities

Source: XF
Type: UNKNOWN
weblogic-viewerrorlog-xss(21984)

Source: CCN
Type: BEA Systems Security Advisory: (BEA05-80.01)
Patches available to prevent multiple cross-site scripting (XSS) vulnerabilities

Source: CCN
Type: BEA Systems Inc. Security Advisory: (BEA05-80.02)
Patches available to prevent multiple cross-site scripting (XSS) vulnerabilities

Vulnerable Configuration:

Configuration 1:

cpe:/a:bea:weblogic_server:6.1:*:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:*:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:sp6:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:6.1:sp7:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:*:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:*:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:7.0:sp6:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:8.1:*:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:8.1:*:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:9.0:*:*:*:*:*:*:*

OR cpe:/a:bea:weblogic_server:9.0:*:express:*:*:*:*:*

Configuration CCN 1:

cpe:/a:oracle:weblogic_server:9.0:*:*:*:*:*:*:*

Denotes that component is vulnerable