| Vulnerability Name: | CVE-2005-4758 (CCN-22577) | ||||||||
| Assigned: | 2005-10-12 | ||||||||
| Published: | 2005-10-12 | ||||||||
| Updated: | 2018-09-27 | ||||||||
| Summary: | Unspecified vulnerability in the Administration server in BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier allows remote authenticated Admin users to read arbitrary files via unknown attack vectors related to an "internal servlet" accessed through HTTP. | ||||||||
| CVSS v3 Severity: | 3.5 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N)
| ||||||||
| CVSS v2 Severity: | 4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N)
| ||||||||
| Vulnerability Type: | CWE-Other | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: MITRE Type: CNA CVE-2005-4758 Source: BEA Type: Patch, Vendor Advisory BEA05-94.00 Source: CCN Type: BEA Systems Inc. Web site BEA Product Documentation Source: CCN Type: SA17138 BEA WebLogic 24 Vulnerabilities and Security Issues Source: SECUNIA Type: Third Party Advisory 17138 Source: CCN Type: OSVDB ID: 20101 BEA WebLogic Unspecified Internal Servlet Arbitrary File Access Source: BID Type: Third Party Advisory, VDB Entry 15052 Source: CCN Type: BID-15052 BEA WebLogic Server and WebLogic Express Multiple Vulnerabilities Source: XF Type: UNKNOWN weblogic-restriction-servlet-gain-access(22577) Source: CCN Type: BEA Systems Security Advisory: (BEA05-94.00) The local file system may be accessed remotely by a user granted the Admin security role. | ||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||
| BACK | |||||||||