CVE-2005-1747 json
Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Service…
published 2005-05-24 21 y ago modified 2026-06-16 4 mo ago also EUVD-2005-1749
- cvss
- 6.8
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 5.1%
- EPSS 5.1% chance of exploitation in 30 days, percentile 92%
- public exploits
- 0
- none known
Summary
Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Service Pack 6, allow remote attackers to inject arbitrary web script or HTML, and possibly gain administrative privileges, via the (1) j_username or (2) j_password parameters in the login page (LoginForm.jsp), (3) parameters to the error page in the Administration Console, (4) unknown vectors in the Server Console while the administrator has an active session to obtain the ADMINCONSOLESESSION cookie, or (5) an alternate vector in the Server Console that does not require an active session but also leaks the username and password.
Exploit prediction
5.11% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
References
-
dev2dev.bea.com
/pub/advisory/130
vendor-advisory
-
secunia.com
/advisories/15486
third-party-advisory, vendor-advisory
- appsecinc.com /resources/alerts/general/BEA-002.html
-
marc.info
/?l=bugtraq&m=111695921212456&w=2
mailing-list
-
marc.info
/?l=bugtraq&m=111722380313416&w=2
mailing-list
-
securitytracker.com
/id?1014049
vdb-entry
-
vupen.com
/english/advisories/2005/0607
vdb-entry
-
marc.info
/?l=bugtraq&m=111695844803328&w=2
mailing-list
-
securityfocus.com
/bid/13717
vdb-entry
- appsecinc.com /resources/alerts/general/BEA-001.html
- acrossecurity.com /aspr/ASPR-2005-05-24-2-PUB.txt
-
marc.info
/?l=bugtraq&m=111722298705561&w=2
mailing-list
- acrossecurity.com /aspr/ASPR-2005-05-24-1-PUB.txt
Sources
- CVE List CVE-2005-1747
- NVD CVE-2005-1747
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.