PT-2008-2515 · Bea · Bea Weblogic Server

Published 2008-02-22 · Updated 2018-10-15 · CVE-2008-0901

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic Server and Express versions 7.0 through 10.0

Description The issue allows remote attackers to conduct brute force password guessing attacks. This is possible even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not.

Recommendations For versions 7.0 through 10.0, consider implementing additional security measures to prevent brute force attacks, such as limiting the number of login attempts or temporarily disabling access after a certain number of failed attempts. As a temporary workaround, restrict access to sensitive areas of the server to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-255

CWE-200

Related Identifiers

CVE-2008-0901

Affected Products

Bea Weblogic Server

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2008-0901 · Security Note
• http://dev2dev.bea.com/pub/advisory/271 · Patch, Vendor Advisory
• http://s21sec.com/avisos/s21sec-040-en.txt · Note
• http://secunia.com/advisories/29041 · Note
• http://securityfocus.com/archive/1/488686/100/0/threaded · Note
• http://vupen.com/english/advisories/2008/0612/references · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0901 · Note
• http://securitytracker.com/id?1019449 · Note