PT-2008-2509 · Bea · Bea Weblogic Server+1

Published 2008-02-22 · Updated 2011-03-08 · CVE-2008-0895

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server and WebLogic Express versions 6.1 through 10.0

Description The issue allows remote attackers to bypass authentication for application servlets by using crafted request headers.

Recommendations For versions 6.1 through 10.0, update to a version that includes a fix for this issue to prevent authentication bypass.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2008-0895

Affected Products

Bea Weblogic Server

Weblogic Express

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2008-0895 · Security Note
• http://secunia.com/advisories/29041 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0895 · Note
• http://dev2dev.bea.com/pub/advisory/265 · Patch, Vendor Advisory
• http://securitytracker.com/id?1019443 · Note
• http://vupen.com/english/advisories/2008/0612/references · Note