CVE-2005-1747
Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Service Pack 6, allow remote attackers to inject arbitrary web script or HTML, and possibly gain administrative privileges, via the (1) j_username or (2) j_password parameters in the login page (LoginForm.jsp), (3) parameters to the error page in the Administration Console, (4) unknown vectors in the Server Console while the administrator has an active session to obtain the ADMINCONSOLESESSION cookie, or (5) an alternate vector in the Server Console that does not require an active session but also leaks the username and password.
Key facts
- CVSS score
- 6.8 (v2.0)
- Severity
- MEDIUM
- CVSS vector
AV:N/AC:M/Au:N/C:P/I:P/A:P- EPSS score
- 5.1% (92th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2005-1749)
- Published
- May 24, 2005
- NVD last modified
- June 16, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2005-1749 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.
View on the EU Vulnerability DatabaseAffected products
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
- bea / weblogic server
and 26 more…
Certified products that may be affected
2 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.
- BEA WebLogic Server 8.1 SP5 - BEA Systems, Inc. - Common Criteria CCEVS-VR-0023-2006 - archived
- BEA WebLogic Server 7.0 SP6 with BEA05-107.00 Advisory Patch - BEA Systems, Inc. - Common Criteria CCEVS-VR-0006-2006 - archived
References
- http://dev2dev.bea.com/pub/advisory/130(Vendor Advisory)
- http://marc.info/?l=bugtraq&m=111695844803328&w=2
- http://marc.info/?l=bugtraq&m=111695921212456&w=2
- http://marc.info/?l=bugtraq&m=111722298705561&w=2
- http://marc.info/?l=bugtraq&m=111722380313416&w=2
- http://secunia.com/advisories/15486(Vendor Advisory)
- http://securitytracker.com/id?1014049
- http://www.acrossecurity.com/aspr/ASPR-2005-05-24-1-PUB.txt
- http://www.acrossecurity.com/aspr/ASPR-2005-05-24-2-PUB.txt
- http://www.appsecinc.com/resources/alerts/general/BEA-001.html
- http://www.appsecinc.com/resources/alerts/general/BEA-002.html
- http://www.securityfocus.com/bid/13717
- http://www.vupen.com/english/advisories/2005/0607
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain