CVE-2008-0900: Medium severity oracle weblogic server vulnerability
Published Feb 22, 2008
·Updated
Session fixation vulnerability in BEA WebLogic Server and Express 8.1 SP4 through SP6, 9.2 through MP1, and 10.0 allows remote authenticated users to hijack web sessions via unknown vectors.
Affected Software
11 affected components
Bea WebLogic Server=9.2
Bea WebLogic Server=8.1-sp6
Bea WebLogic Server=8.1-sp5
Bea WebLogic Server=8.1-sp5
Bea Systems Weblogic Express=10.0
Bea WebLogic Server=8.1-sp4
Bea WebLogic Server=10.0
Bea WebLogic Server=9.2-mp1
Bea WebLogic Server=8.1-sp6
Bea WebLogic Server=8.1-sp4
Bea Systems Weblogic Express=9.2-mp1
Remediation
Patch Available
Event History
Feb 22, 2008
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2008-0900?
CVE-2008-0900 is considered to have a high severity due to the potential for session hijacking by remote authenticated users.
2
How do I fix CVE-2008-0900?
To fix CVE-2008-0900, upgrade your BEA WebLogic Server or Express to the latest version as provided by Oracle.
3
What are the affected versions of CVE-2008-0900?
CVE-2008-0900 affects BEA WebLogic Server versions 8.1 SP4 through SP6, 9.2 through MP1, and 10.0.
4
Can CVE-2008-0900 be exploited remotely?
Yes, CVE-2008-0900 can be exploited remotely by authenticated users to hijack web sessions.
5
Is CVE-2008-0900 related to session fixation?
Yes, CVE-2008-0900 is specifically a session fixation vulnerability that allows session hijacking.