CVE-2008-0870

BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 2, under certain circumstances, can redirect a user from the https:// URI for the Portal Administration Console to an http URI, which allows remote attackers to sniff the session.

Published: Feb 21, 2008
Updated: Apr 13, 2023
CVE: CVE-2008-0870
Severity: High
Exploit:

CVSS v2:

Severity: High
Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

CWE-59

Affected Software
References

Software	From	Fixed in
bea_systems / weblogic_portal	9.2-mp2	9.2-mp2.x
bea_systems / weblogic_portal	10.0	10.0.x
bea_systems / weblogic_portal	9.2-mp1	9.2-mp1.x
oracle / weblogic_portal	9.2	9.2.x

http://dev2dev.bea.com/pub/advisory/264
http://secunia.com/advisories/29041
http://www.securitytracker.com/id?1019442
http://www.vupen.com/english/advisories/2008/0613

Vulnerability Database

289,599

CVE-2008-0870