CVE-2008-0901

BEA Weblogic Server - Information Disclosure

Title source: rule

Description

BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not.

References (6)

[Patch] http://dev2dev.bea.com/pub/advisory/271

[Various Sources] http://www.s21sec.com/avisos/s21sec-040-en.txt

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id?1019449

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/488686/100/0/threaded

[Third Party Advisory] http://secunia.com/advisories/29041

[Third Party Advisory] http://www.vupen.com/english/advisories/2008/0612/references

Scores

EPSS 0.0074

EPSS Percentile 72.6%

Classification

CWE

CWE-200 CWE-255

Status draft

Affected Products (22)

bea/weblogic_server

... and 7 more

Timeline

Published Feb 22, 2008

Tracked Since Feb 18, 2026