Vulnerability Database

289,599

Total vulnerabilities in the database

CVE-2008-0901

BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not.

  • Published: Feb 22, 2008
  • Updated: Apr 13, 2023
  • CVE: CVE-2008-0901
  • Severity: High
  • Exploit:

CVSS v2:

  • Severity: High
  • Score: 7.1
  • AV:N/AC:M/Au:N/C:C/I:N/A:N

CWEs:

Software From Fixed in
bea / weblogic_server 7.0-sp7 7.0-sp7.x
bea / weblogic_server 9.2-mp2 9.2-mp2.x
bea / weblogic_server 8.1 8.1.x
bea / weblogic_server 9.0 9.0.x
bea / weblogic_server 9.2 9.2.x
bea / weblogic_server 7.0-sp4 7.0-sp4.x
bea / weblogic_server 7.0 7.0.x
bea / weblogic_server 7.0-sp6 7.0-sp6.x
bea / weblogic_server 7.0-sp3 7.0-sp3.x
bea / weblogic_server 8.1-sp5 8.1-sp5.x
bea / weblogic_server 8.1-sp3 8.1-sp3.x
bea / weblogic_server 7.0-sp2 7.0-sp2.x
bea / weblogic_server 7.0-sp5 7.0-sp5.x
bea / weblogic_server 9.1 9.1.x
bea / weblogic_server 10.0 10.0.x
bea_systems / weblogic_server 10.0_mp1 10.0_mp1.x
bea / weblogic_server 9.2-mp1 9.2-mp1.x
bea / weblogic_server 8.1-sp2 8.1-sp2.x
bea / weblogic_server 7.0-sp1 7.0-sp1.x
bea / weblogic_server 8.1-sp6 8.1-sp6.x
bea / weblogic_server 8.1-sp1 8.1-sp1.x
bea / weblogic_server 8.1-sp4 8.1-sp4.x