CVE-2005-1744

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

BEA WebLogic Server and WebLogic Express 7.0 through Service Pack 5 does not log out users when an application is redeployed, which allows those users to continue to access the application without having to log in again, which may be in violation of newly changed security constraints or role mappings.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-459

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://dev2dev.bea.com/pub/advisory/127Product
http://secunia.com/advisories/15486Broken Link, Vendor Advisory
http://securitytracker.com/id?1014049Broken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/13717Broken Link, Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2005/0604Broken Link
http://dev2dev.bea.com/pub/advisory/127Product
http://secunia.com/advisories/15486Broken Link, Vendor Advisory
http://securitytracker.com/id?1014049Broken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/13717Broken Link, Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2005/0604Broken Link

Timeline

Published: May 24, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-17454.6The UserLogin control in BEA WebLogic Portal 8.1 through Service Pack 3 prints the password to standard output when an incorrect login attem CVE-2005-17465.0The cluster cookie parsing code in BEA WebLogic Server 7.0 through Service Pack 5 attempts to contact any host or port specified in a cookie CVE-2005-17476.8Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Service P CVE-2005-17485.0The embedded LDAP server in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Service Pack 5, allows remote anonym CVE-2005-17495.0Buffer overflow in BEA WebLogic Server and WebLogic Express 6.1 Service Pack 4 allows remote attackers to cause a denial of service (CPU con CVE-2005-17507.5SQL injection vulnerability in login.asp in ezdwc NewsletterEz 3.0 allows remote attackers to execute arbitrary SQL commands via the passwor CVE-2005-17513.7Race condition in shtool 2.0.1 and earlier allows local users to create or modify arbitrary files via a symlink attack on the .shtool.$$ tem CVE-2005-17526.4viewFile.php in the scm component of Gforge before 4.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the CVE-2005-17535.0ReadMessage.jsp in JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to view other users' e-mail atta CVE-2005-17545.0JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to read arbitrary files via a full pathname in the CVE-2005-17556.4PHP remote file inclusion vulnerability in poll_vote.php in PHP Poll Creator 1.01 allows remote attackers to execute arbitrary PHP code via CVE-2005-17564.3Cross-site scripting (XSS) vulnerability in the ModWeb agent for Novell NetMail 3.52 before 3.52C allows remote attackers to inject arbitrar