CVE-2008-0900

BEA WebLogic Server and Express 8.1 SP4-SP6, 9.2-MP1, 10.0 - Authenticated Session Fixation

Title source: llm
STIX 2.1

Description

Session fixation vulnerability in BEA WebLogic Server and Express 8.1 SP4 through SP6, 9.2 through MP1, and 10.0 allows remote authenticated users to hijack web sessions via unknown vectors.

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1019439
Patch vendor-advisory x_refsource_bea
http://dev2dev.bea.com/pub/advisory/270
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29041
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/0612/references

Scores

EPSS 0.0453
EPSS Percentile 89.3%

Details

CWE
CWE-264
Status published
Products (5)
bea/weblogic_server 8.1 sp4 (6 CPE variants)
bea/weblogic_server 9.2 (2 CPE variants)
bea/weblogic_server 10.0
bea_systems/weblogic_express 9.2 mp1
bea_systems/weblogic_express 10.0
Published Feb 22, 2008
Tracked Since Feb 18, 2026