VulnerabilityModified
CVE-2008-0864
Admin Tools in BEA WebLogic Portal 8.1 SP3 through SP6 can inadvertently remove entitlements for pages when an administrator edits the page definition label, which might allow remote attackers to bypass intended access restrictions.
MEDIUM 5.0EPSS 1.81%
Does this matter?
Lower severity and a low EPSS score (1.81%). Track it; it rarely justifies an emergency change on its own.
Description
Admin Tools in BEA WebLogic Portal 8.1 SP3 through SP6 can inadvertently remove entitlements for pages when an administrator edits the page definition label, which might allow remote attackers to bypass intended access restrictions.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 1.81% probability · 77th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- bea systems/weblogic portal · oracle/weblogic portal
- Source
- cve@mitre.org
References
- http://dev2dev.bea.com/pub/advisory/256
- http://secunia.com/advisories/29041
- http://www.securitytracker.com/id?1019454
- http://www.vupen.com/english/advisories/2008/0613
- http://dev2dev.bea.com/pub/advisory/256
- http://secunia.com/advisories/29041
- http://www.securitytracker.com/id?1019454
- http://www.vupen.com/english/advisories/2008/0613
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.