CVE-2008-0899: XSS

Published Feb 22, 2008

Updated

Cross-site scripting (XSS) vulnerability in the Administration Console in BEA WebLogic Server and Express 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via URLs that are not properly handled by the Unexpected Exception Page.

Affected Software

5 affected components

Bea WebLogic Server=9.0

Bea WebLogic Server=9.1

Bea WebLogic Server=9.2

Bea WebLogic Server=9.2-mp1

Bea WebLogic Server=10.0

Remediation

Patch Available

http://dev2dev.bea.com/pub/advisory/269

Event History

Feb 22, 2008

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-0899?

CVE-2008-0899 is classified as a medium severity vulnerability due to the potential for cross-site scripting attacks.

How do I fix CVE-2008-0899?

To mitigate CVE-2008-0899, upgrade your BEA WebLogic Server to a patched version that addresses this vulnerability.

What types of attacks can CVE-2008-0899 lead to?

CVE-2008-0899 can lead to cross-site scripting (XSS) attacks that allow attackers to inject arbitrary web scripts or HTML.

Which versions of WebLogic Server are affected by CVE-2008-0899?

CVE-2008-0899 affects WebLogic Server versions 9.0, 9.1, 9.2, and 10.0.

Is there a workaround for CVE-2008-0899?

Currently, there is no documented workaround for CVE-2008-0899 other than applying the recommended updates.