Vulnerability in Bea Weblogic Server
CVE-2005-4767
BEA WebLogic Server and WebLogic Express 8.1 SP5 and earlier, and 7.0 SP6 and earlier, when using username/password authentication, does not lock out a username after the maximum number of invalid login attempts, which makes it easier for remote attackers to guess the password.
EPSS: 0.014 (69.7th percentile) — read the EPSS interpretation.
Affected products
- Bea Weblogic_server — versions 7.0, 8.1
- N/a — versions n/a
References
- cve@mitre.org (Patch, vdb-entry, x_refsource_BID)
- cve@mitre.org (vendor-advisory, x_refsource_BEA, Patch, Vendor Advisory)
- cve@mitre.org (Patch, x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (vendor-advisory, x_refsource_BEA, Patch, Vendor Advisory)
- cve@mitre.org (Patch, vdb-entry, x_refsource_BID)