CVE-2008-0901: Infoleak

Published Feb 22, 2008

Updated

BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not.

Affected Software

22 affected components

Bea WebLogic Server=7.0

Bea WebLogic Server=7.0-sp1

Bea WebLogic Server=7.0-sp2

Bea WebLogic Server=7.0-sp3

Bea WebLogic Server=7.0-sp4

Bea WebLogic Server=7.0-sp5

Bea WebLogic Server=7.0-sp6

Bea WebLogic Server=7.0-sp7

Bea WebLogic Server=8.1

Bea WebLogic Server=8.1-sp1

Bea WebLogic Server=8.1-sp2

Bea WebLogic Server=8.1-sp3

Bea WebLogic Server=8.1-sp4

Bea WebLogic Server=8.1-sp5

Bea WebLogic Server=8.1-sp6

Bea WebLogic Server=9.0

Bea WebLogic Server=9.1

Bea WebLogic Server=9.2

Bea WebLogic Server=9.2-mp1

Bea WebLogic Server=9.2-mp2

Bea WebLogic Server=10.0

Bea Systems Weblogic Server=10.0_mp1

Remediation

Patch Available

http://dev2dev.bea.com/pub/advisory/271

Event History

Feb 22, 2008

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-0901?

CVE-2008-0901 is considered to have a medium severity rating due to its potential for remote exploitation.

How do I fix CVE-2008-0901?

To fix CVE-2008-0901, apply the latest patches or updates provided by Oracle for affected versions of WebLogic Server.

Is CVE-2008-0901 exploitable remotely?

Yes, CVE-2008-0901 can be exploited remotely by attackers through crafted URLs.

What versions of WebLogic Server are affected by CVE-2008-0901?

CVE-2008-0901 affects BEA WebLogic Server and Express versions from 7.0 through 10.0.

Can account lockout prevent exploitation of CVE-2008-0901?

No, even when account lockout is activated, CVE-2008-0901 allows attackers to conduct brute force password guessing attacks.