Vulnerability Details CVE-2005-4767
BEA WebLogic Server and WebLogic Express 8.1 SP5 and earlier, and 7.0 SP6 and earlier, when using username/password authentication, does not lock out a username after the maximum number of invalid login attempts, which makes it easier for remote attackers to guess the password.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.013
EPSS Ranking 78.9%
CVSS Severity
CVSS v2 Score 5.1
References
- http://dev2dev.bea.com/pub/advisory/161
- http://dev2dev.bea.com/pub/advisory/178
- http://secunia.com/advisories/17138
- http://www.securityfocus.com/bid/15052
- http://www.securityfocus.com/bid/17168
- http://dev2dev.bea.com/pub/advisory/161
- http://dev2dev.bea.com/pub/advisory/178
- http://secunia.com/advisories/17138
- http://www.securityfocus.com/bid/15052
- http://www.securityfocus.com/bid/17168
Products affected by CVE-2005-4767
-
cpe:2.3:a:bea:weblogic_server:7.0
-
cpe:2.3:a:bea:weblogic_server:8.1