CVE-2005-4766
Summary
| CVE | CVE-2005-4766 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2005-12-31 05:00:00 UTC |
| Updated | 2025-04-03 01:03:51 UTC |
| Description | BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not encrypt multicast traffic, which might allow remote attackers to read sensitive cluster synchronization messages by sniffing the multicast traffic. |
Risk And Classification
Primary CVSS: v2.0 5.4 from [email protected]
AV:N/AC:H/Au:N/C:C/I:N/A:N
Problem Types: NVD-CWE-Other | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
HighAuthentication
NoneConfidentiality
CompleteIntegrity
NoneAvailability
NoneAV:N/AC:H/Au:N/C:C/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Bea | Weblogic Server | 7.0 | All | All | All |
| Application | Bea | Weblogic Server | 7.0 | All | express | All |
| Application | Bea | Weblogic Server | 7.0 | All | win32 | All |
| Application | Bea | Weblogic Server | 7.0 | sp1 | All | All |
| Application | Bea | Weblogic Server | 7.0 | sp1 | express | All |
| Application | Bea | Weblogic Server | 7.0 | sp1 | win32 | All |
| Application | Bea | Weblogic Server | 7.0 | sp2 | All | All |
| Application | Bea | Weblogic Server | 7.0 | sp2 | express | All |
| Application | Bea | Weblogic Server | 7.0 | sp2 | win32 | All |
| Application | Bea | Weblogic Server | 7.0 | sp3 | All | All |
| Application | Bea | Weblogic Server | 7.0 | sp3 | express | All |
| Application | Bea | Weblogic Server | 7.0 | sp3 | win32 | All |
| Application | Bea | Weblogic Server | 7.0 | sp4 | All | All |
| Application | Bea | Weblogic Server | 7.0 | sp4 | express | All |
| Application | Bea | Weblogic Server | 7.0 | sp4 | win32 | All |
| Application | Bea | Weblogic Server | 7.0 | sp5 | All | All |
| Application | Bea | Weblogic Server | 7.0 | sp5 | express | All |
| Application | Bea | Weblogic Server | 7.0 | sp5 | win32 | All |
| Application | Bea | Weblogic Server | 8.1 | All | All | All |
| Application | Bea | Weblogic Server | 8.1 | All | express | All |
| Application | Bea | Weblogic Server | 8.1 | All | win32 | All |
| Application | Bea | Weblogic Server | 8.1 | sp1 | All | All |
| Application | Bea | Weblogic Server | 8.1 | sp1 | express | All |
| Application | Bea | Weblogic Server | 8.1 | sp1 | win32 | All |
| Application | Bea | Weblogic Server | 8.1 | sp2 | All | All |
| Application | Bea | Weblogic Server | 8.1 | sp2 | express | All |
| Application | Bea | Weblogic Server | 8.1 | sp2 | win32 | All |
| Application | Bea | Weblogic Server | 8.1 | sp3 | All | All |
| Application | Bea | Weblogic Server | 8.1 | sp3 | express | All |
| Application | Bea | Weblogic Server | 8.1 | sp3 | win32 | All |
| Application | Bea | Weblogic Server | 8.1 | sp4 | All | All |
| Application | Bea | Weblogic Server | 8.1 | sp4 | express | All |
| Application | Bea | Weblogic Server | 8.1 | sp4 | win32 | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Secunia - Advisories - BEA WebLogic 24 Vulnerabilities and Security Issues | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Patch, Vendor Advisory |
| BEA WebLogic Server and WebLogic Express Multiple Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Patch |
| Multicast data is not encrypted. | af854a3a-2127-422b-91ae-364da2661108 | dev2dev.bea.com | Patch, Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.