Vulnerability Description
BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, do not properly "constrain" a "/" (slash) servlet root URL pattern, which might allow remote attackers to bypass intended servlet protections.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bea | Weblogic Server | 7.0 |
References
- http://dev2dev.bea.com/pub/advisory/147PatchVendor Advisory
- http://secunia.com/advisories/17138Third Party Advisory
- http://www.securityfocus.com/bid/15052Third Party AdvisoryVDB Entry
- http://dev2dev.bea.com/pub/advisory/147PatchVendor Advisory
- http://secunia.com/advisories/17138Third Party Advisory
- http://www.securityfocus.com/bid/15052Third Party AdvisoryVDB Entry
FAQ
What is CVE-2005-4757?
CVE-2005-4757 is a vulnerability with a CVSS score of 7.5 (HIGH). BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, do not properly "constrain" a "/" (slash) servlet root URL pattern, which might allow remote attackers to bypass ...
How severe is CVE-2005-4757?
CVE-2005-4757 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2005-4757?
Check the references section above for vendor advisories and patch information. Affected products include: Bea Weblogic Server.