PT-2008-2514 · Bea · Bea Weblogic Server

Published 2008-02-22 · Updated 2011-03-08 · CVE-2008-0900

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server and Express versions 8.1 SP4 through SP6 BEA WebLogic Server and Express versions 9.2 through MP1 BEA WebLogic Server and Express version 10.0

Description A session fixation issue allows remote authenticated users to hijack web sessions. The exact vectors used for the hijacking are not specified.

Recommendations For versions 8.1 SP4 through SP6, update to a version outside of this range to resolve the issue. For versions 9.2 through MP1, update to a version beyond MP1 to address the problem. For version 10.0, update to a newer version to fix the issue. As a temporary workaround, consider implementing additional session validation to minimize the risk of session hijacking.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-0900

Affected Products

Bea Weblogic Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2008-0900 · Security Note
• http://secunia.com/advisories/29041 · Note
• http://dev2dev.bea.com/pub/advisory/270 · Patch, Vendor Advisory
• http://securitytracker.com/id?1019439 · Note
• http://vupen.com/english/advisories/2008/0612/references · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0900 · Note