CVE-2008-0900

BEA Weblogic Server - Access Control

Title source: rule

Description

Session fixation vulnerability in BEA WebLogic Server and Express 8.1 SP4 through SP6, 9.2 through MP1, and 10.0 allows remote authenticated users to hijack web sessions via unknown vectors.

References (4)

[Patch] http://dev2dev.bea.com/pub/advisory/270

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id?1019439

[Third Party Advisory] http://secunia.com/advisories/29041

[Third Party Advisory] http://www.vupen.com/english/advisories/2008/0612/references

Scores

EPSS 0.0453

EPSS Percentile 89.0%

Classification

CWE

CWE-264

Status draft

Affected Products (11)

bea/weblogic_server

bea_systems/weblogic_express

Timeline

Published Feb 22, 2008

Tracked Since Feb 18, 2026