CVE-2008-0901
BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.24%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not.
- CVSS 2.0
- 7.1 HIGHAV:N/AC:M/Au:N/C:C/I:N/A:N
- EPSS
- 2.24% probability · 82th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200, CWE-255
- Affected
- bea/weblogic server · bea systems/weblogic server
- Source
- cve@mitre.org
References
- http://dev2dev.bea.com/pub/advisory/271Patch
- http://secunia.com/advisories/29041
- http://www.s21sec.com/avisos/s21sec-040-en.txt
- http://www.securityfocus.com/archive/1/488686/100/0/threaded
- http://www.securitytracker.com/id?1019449
- http://www.vupen.com/english/advisories/2008/0612/references
- http://dev2dev.bea.com/pub/advisory/271Patch
- http://secunia.com/advisories/29041
- http://www.s21sec.com/avisos/s21sec-040-en.txt
- http://www.securityfocus.com/archive/1/488686/100/0/threaded
- http://www.securitytracker.com/id?1019449
- http://www.vupen.com/english/advisories/2008/0612/references
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.