CVE-2005-1380: XSS
Published May 2, 2005
·Updated
Cross-site scripting (XSS) vulnerability in BEA Admin Console 8.1 allows remote attackers to execute arbitrary web script or HTML via the server parameter to a JndiFramesetAction action.
Affected Software
15 affected components
Bea WebLogic Server=8.1
Bea WebLogic Server=8.1-sp4
Bea WebLogic Server=8.1
Bea WebLogic Server=8.1-sp1
Bea WebLogic Server=8.1-sp3
Bea WebLogic Server=8.1-sp3
Bea WebLogic Server=8.1
Bea WebLogic Server=8.1-sp4
Bea WebLogic Server=8.1-sp1
Bea WebLogic Server=8.1-sp3
Bea WebLogic Server=8.1-sp2
Bea WebLogic Server=8.1-sp1
Bea WebLogic Server=8.1-sp2
Bea WebLogic Server=8.1-sp4
Bea WebLogic Server=8.1-sp2
Event History
May 2, 2005
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2005-1380?
The severity of CVE-2005-1380 is classified as medium due to its potential for cross-site scripting attacks.
2
How do I fix CVE-2005-1380?
To fix CVE-2005-1380, update to a non-vulnerable version of BEA WebLogic Server beyond 8.1.
3
What software is affected by CVE-2005-1380?
CVE-2005-1380 affects various versions of BEA WebLogic Server 8.1, including service packs and express versions.
4
Who can exploit CVE-2005-1380?
Remote attackers can exploit CVE-2005-1380 by crafting malicious requests to the vulnerable BEA Admin Console.
5
What are the implications of CVE-2005-1380?
Exploitation of CVE-2005-1380 can allow attackers to execute arbitrary web scripts or HTML in the context of the victim's browser.