CVE-2005-1746 — Weblogic Server vulnerability

3 documents3 sources

Severity

5.0MEDIUMNVD

EPSS

0.9%

top 24.99%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

BEA Weblogic Server Oracle Weblogic Portal

Timeline

PublishedMay 24

Latest updateMay 1

Description

The cluster cookie parsing code in BEA WebLogic Server 7.0 through Service Pack 5 attempts to contact any host or port specified in a cookie, even when it is not in the cluster, which allows remote attackers to cause a denial of service (cluster slowdown) via modified cookies.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages2 packages

▶NVDbea/weblogic_server5 versions+4

▶NVDoracle/weblogic_portal8.0

🔴Vulnerability Details

GHSA

GHSA-hx82-h7cq-j4xg: The cluster cookie parsing code in BEA WebLogic Server 7↗2022-05-01

▶

CVEList

CVE-2005-1746: The cluster cookie parsing code in BEA WebLogic Server 7↗2005-05-24

▶