CVE-2008-0901

BEA WebLogic Server 7.0-10.0 - Unauthenticated Password Brute-Force via URL Response

Title source: llm
STIX 2.1

Description

BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not.

References (6)

Core 6
Core References
Various Sources x_refsource_misc
http://www.s21sec.com/avisos/s21sec-040-en.txt
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1019449
Patch vendor-advisory x_refsource_bea
http://dev2dev.bea.com/pub/advisory/271
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29041
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/0612/references
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/488686/100/0/threaded

Scores

EPSS 0.0079
EPSS Percentile 74.1%

Details

CWE
CWE-200 CWE-255
Status published
Products (7)
bea/weblogic_server 7.0 (8 CPE variants)
bea/weblogic_server 8.1 (7 CPE variants)
bea/weblogic_server 9.0
bea/weblogic_server 9.1
bea/weblogic_server 9.2 (3 CPE variants)
bea/weblogic_server 10.0
bea_systems/weblogic_server 10.0_mp1
Published Feb 22, 2008
Tracked Since Feb 18, 2026