VulnerabilityModified
CVE-2005-4766
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not encrypt multicast traffic, which might allow remote attackers to read sensitive cluster synchronization messages by sniffing the multicast traffic.
MEDIUM 5.4EPSS 1.41%
Does this matter?
Lower severity and a low EPSS score (1.41%). Track it; it rarely justifies an emergency change on its own.
Description
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not encrypt multicast traffic, which might allow remote attackers to read sensitive cluster synchronization messages by sniffing the multicast traffic.
- CVSS 2.0
- 5.4 MEDIUMAV:N/AC:H/Au:N/C:C/I:N/A:N
- EPSS
- 1.41% probability · 71th percentile
- CISA KEV
- Not listed
- Affected
- bea/weblogic server
- Source
- cve@mitre.org
References
- http://dev2dev.bea.com/pub/advisory/157Patch, Vendor Advisory
- http://secunia.com/advisories/17138Patch, Vendor Advisory
- http://www.securityfocus.com/bid/15052Patch
- http://dev2dev.bea.com/pub/advisory/157Patch, Vendor Advisory
- http://secunia.com/advisories/17138Patch, Vendor Advisory
- http://www.securityfocus.com/bid/15052Patch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.