CVE-2008-0870: High severity bea weblogic portal vulnerability

Published Feb 21, 2008

Updated

BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 2, under certain circumstances, can redirect a user from the https:// URI for the Portal Administration Console to an http URI, which allows remote attackers to sniff the session.

Affected Software

4 affected components

Bea Systems Weblogic Portal=9.2-mp2

Bea Systems Weblogic Portal=10.0

Bea Systems Weblogic Portal=9.2-mp1

Oracle Weblogic Portal=9.2

Remediation

Patch Available

http://dev2dev.bea.com/pub/advisory/264

Event History

Feb 21, 2008

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2008-0870?

CVE-2008-0870 has been identified with a high severity due to the potential for session sniffing.

How do I fix CVE-2008-0870?

To mitigate CVE-2008-0870, ensure that you are using secure connections and apply the latest patches from BEA Systems or Oracle.

What versions are affected by CVE-2008-0870?

CVE-2008-0870 affects BEA WebLogic Portal versions 9.2 through Maintenance Pack 2 and 10.0.

What kind of attack does CVE-2008-0870 allow?

CVE-2008-0870 allows remote attackers to sniff session information due to a redirection from HTTPS to HTTP.

Is there a workaround for CVE-2008-0870?

While the best solution is to update to a patched version, you can also restrict access to the Portal Administration Console to trusted networks.