PT-2008-2514 · Bea · Bea Weblogic Server

Publicado 2008-02-22 · Atualizado 2011-03-08 · CVE-2008-0900

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server and Express versions 8.1 SP4 through SP6 BEA WebLogic Server and Express versions 9.2 through MP1 BEA WebLogic Server and Express version 10.0

Description A session fixation issue allows remote authenticated users to hijack web sessions. The exact vectors used for the hijacking are not specified.

Recommendations For versions 8.1 SP4 through SP6, update to a version outside of this range to resolve the issue. For versions 9.2 through MP1, update to a version beyond MP1 to address the problem. For version 10.0, update to a newer version to fix the issue. As a temporary workaround, consider implementing additional session validation to minimize the risk of session hijacking.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-0900

Produtos afetados

Bea Weblogic Server

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2008-0900 · Nota de Segurança
• http://secunia.com/advisories/29041 · Nota
• http://dev2dev.bea.com/pub/advisory/270 · Correção, Aviso do Fabricante
• http://securitytracker.com/id?1019439 · Nota
• http://vupen.com/english/advisories/2008/0612/references · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0900 · Nota