PT-2008-2509 · Bea · Bea Weblogic Server+1

Publicado 2008-02-22 · Atualizado 2011-03-08 · CVE-2008-0895

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server and WebLogic Express versions 6.1 through 10.0

Description The issue allows remote attackers to bypass authentication for application servlets by using crafted request headers.

Recommendations For versions 6.1 through 10.0, update to a version that includes a fix for this issue to prevent authentication bypass.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2008-0895

Produtos afetados

Bea Weblogic Server

Weblogic Express

Referências · 6

• http://secunia.com/advisories/29041 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0895 · Nota
• http://dev2dev.bea.com/pub/advisory/265 · Correção, Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-0895 · Nota de Segurança
• http://securitytracker.com/id?1019443 · Nota
• http://vupen.com/english/advisories/2008/0612/references · Nota