VulnerabilityModified
CVE-2008-0900
Session fixation vulnerability in BEA WebLogic Server and Express 8.1 SP4 through SP6, 9.2 through MP1, and 10.0 allows remote authenticated users to hijack web sessions via unknown vectors.
MEDIUM 6.0EPSS 9.99%
Does this matter?
Lower severity and a low EPSS score (9.99%). Track it; it rarely justifies an emergency change on its own.
Description
Session fixation vulnerability in BEA WebLogic Server and Express 8.1 SP4 through SP6, 9.2 through MP1, and 10.0 allows remote authenticated users to hijack web sessions via unknown vectors.
- CVSS 2.0
- 6.0 MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
- EPSS
- 9.99% probability · 95th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- bea/weblogic server · bea systems/weblogic express
- Source
- cve@mitre.org
References
- http://dev2dev.bea.com/pub/advisory/270Patch
- http://secunia.com/advisories/29041
- http://www.securitytracker.com/id?1019439
- http://www.vupen.com/english/advisories/2008/0612/references
- http://dev2dev.bea.com/pub/advisory/270Patch
- http://secunia.com/advisories/29041
- http://www.securitytracker.com/id?1019439
- http://www.vupen.com/english/advisories/2008/0612/references
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.