CVE-2005-4749

HTTP request smuggling vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and…

5.0MediumCVSS base score
1.9%Exploitation in 30 daysEPSS · top 20% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
NonePublic exploitsnone known yet

Description

HTTP request smuggling vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier allows remote attackers to inject arbitrary HTTP headers via unspecified attack vectors.

Timeline

2006
31 Mar 2006
31 Mar 2006
ID reserved
By mitre
1 Apr 20061 day later
1 Apr 2006· 1 day later
Published
2024
16 Sept 202418 years later
16 Sept 2024· 18 years later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2005-4749, by who scored it
Scored by	CVSS	Score	Vector
NVDNVD · Modified	2.0	Medium5.0	AV:N/AC:L/Au:N/C:N/I:P/A:N

EPSS (exploitation in 30 days): 1.9% · top 20% of all CVEs (9 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.0.

Affected products

n/a
- affected n/a

References

BEA05-105.00 (opens in a new tab)vendor-advisoryx_refsource_BEAx_transferred
17163 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
BEA06-105.01 (opens in a new tab)vendor-advisoryx_refsource_BEAx_transferred
15052 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
17138 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2005-4749](https://cveledger.app/badge/CVE-2005-4749.svg)](https://cveledger.app/cve/CVE-2005-4749)

Record last updated 16 Sept 2024, 22:15 UTC.