PT-2008-2515 · Bea · Bea Weblogic Server

Publicado 2008-02-22 · Atualizado 2018-10-15 · CVE-2008-0901

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server and Express versions 7.0 through 10.0

Description The issue allows remote attackers to conduct brute force password guessing attacks. This is possible even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not.

Recommendations For versions 7.0 through 10.0, consider implementing additional security measures to prevent brute force attacks, such as limiting the number of login attempts or temporarily disabling access after a certain number of failed attempts. As a temporary workaround, restrict access to sensitive areas of the server to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-255

CWE-200

Identificadores relacionados

CVE-2008-0901

Produtos afetados

Bea Weblogic Server

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2008-0901 · Nota de Segurança
• http://dev2dev.bea.com/pub/advisory/271 · Correção, Aviso do Fabricante
• http://s21sec.com/avisos/s21sec-040-en.txt · Nota
• http://secunia.com/advisories/29041 · Nota
• http://securityfocus.com/archive/1/488686/100/0/threaded · Nota
• http://vupen.com/english/advisories/2008/0612/references · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0901 · Nota
• http://securitytracker.com/id?1019449 · Nota