CVE-2008-0895: Medium severity oracle weblogic server vulnerability
Published Feb 22, 2008
·Updated
BEA WebLogic Server and WebLogic Express 6.1 through 10.0 allows remote attackers to bypass authentication for application servlets via crafted request headers.
Affected Software
27 affected components
Bea WebLogic Server=6.1-sp4
Bea WebLogic Server=7.0-sp7
Bea WebLogic Server=8.1
Bea WebLogic Server=6.1-sp5
Bea WebLogic Server=9.0
Bea WebLogic Server=9.2
Bea WebLogic Server=6.1-sp6
Bea WebLogic Server=7.0-sp4
Bea WebLogic Server=7.0
Bea WebLogic Server=6.1-sp3
Bea WebLogic Server=7.0-sp6
Bea WebLogic Server=7.0-sp3
Bea WebLogic Server=8.1-sp5
Bea WebLogic Server=8.1-sp3
Bea WebLogic Server=7.0-sp2
Bea WebLogic Server=7.0-sp5
Bea WebLogic Server=9.1
Bea WebLogic Server=6.1-sp1
Bea WebLogic Server=10.0
Bea WebLogic Server=8.1-sp2
Bea WebLogic Server=6.1
Bea WebLogic Server=7.0-sp1
Bea WebLogic Server=8.1-sp6
Bea WebLogic Server=8.1-sp1
Bea WebLogic Server=8.1-sp4
Bea WebLogic Server=6.1-sp2
Bea WebLogic Server=6.1-sp7
Remediation
Patch Available
Event History
Feb 22, 2008
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2008-0895?
CVE-2008-0895 is rated as high severity due to its potential for remote code execution.
2
How do I fix CVE-2008-0895?
To fix CVE-2008-0895, update your BEA WebLogic Server to a version later than 10.0 that has been patched for this vulnerability.
3
Which versions of WebLogic are affected by CVE-2008-0895?
CVE-2008-0895 affects BEA WebLogic Server versions from 6.1 through 10.0, including various service packs.
4
What type of attack does CVE-2008-0895 facilitate?
CVE-2008-0895 allows attackers to bypass authentication for application servlets via crafted request headers.
5
Who should be concerned about CVE-2008-0895?
Organizations using affected versions of BEA WebLogic Server should prioritize mitigating CVE-2008-0895 to protect their applications from unauthorized access.