CVE-2005-4756: High severity oracle weblogic server vulnerability

Published Dec 31, 2005

Updated

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not properly validate derived Principals with multiple PrincipalValidators, which might allow attackers to gain privileges.

Affected Software

22 affected components

Bea WebLogic Server=7.0

Bea WebLogic Server=7.0-sp1

Bea WebLogic Server=7.0-sp2

Bea WebLogic Server=7.0-sp3

Bea WebLogic Server=7.0-sp4

Bea WebLogic Server=7.0-sp5

Bea WebLogic Server=8.1

Bea WebLogic Server=8.1-sp1

Bea WebLogic Server=8.1-sp2

Bea WebLogic Server=8.1-sp3

Bea WebLogic Server=8.1-sp4

Remediation

Patch Available

http://dev2dev.bea.com/pub/advisory/146

Event History

Dec 31, 2005

CVE Published

05:00 AM

Apr 1, 2006

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-4756?

CVE-2005-4756 is classified as a high severity vulnerability due to the potential for privilege escalation.

How do I fix CVE-2005-4756?

To fix CVE-2005-4756, upgrade to the latest version of BEA WebLogic Server or apply the relevant security patches provided by the vendor.

What versions of BEA WebLogic Server are affected by CVE-2005-4756?

CVE-2005-4756 affects BEA WebLogic Server versions 7.0 SP5 and earlier, and 8.1 SP4 and earlier.

What type of attack does CVE-2005-4756 allow?

CVE-2005-4756 may allow an attacker to gain unauthorized privileges through improper validation of derived Principals.

Is there a workaround for CVE-2005-4756 if I cannot upgrade?

There are no documented workarounds for CVE-2005-4756, so upgrading is strongly recommended to mitigate the risk.