CVE-2008-0900
Severity Score
6.0
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Session fixation vulnerability in BEA WebLogic Server and Express 8.1 SP4 through SP6, 9.2 through MP1, and 10.0 allows remote authenticated users to hijack web sessions via unknown vectors.
Vulnerabilidad de fijación de sesión en BEA WebLogic Server y Express de 8.1 SP4 a SP6, de 9.2 a MP1 y 10.0 permite a usuarios autentificados remotamente secuestrar sesiones web a través de vectores desconocidos.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2008-02-22 CVE Reserved
- 2008-02-22 CVE Published
- 2024-07-26 EPSS Updated
- 2024-08-07 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-264: Permissions, Privileges, and Access Controls
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| http://secunia.com/advisories/29041 | Third Party Advisory | |
| http://www.securitytracker.com/id?1019439 | Vdb Entry | |
| http://www.vupen.com/english/advisories/2008/0612/references | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/270 | 2011-03-08 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Bea Search vendor "Bea" | Weblogic Server Search vendor "Bea" for product "Weblogic Server" | 8.1 Search vendor "Bea" for product "Weblogic Server" and version "8.1" | sp4 |
Affected
| ||||||
| Bea Search vendor "Bea" | Weblogic Server Search vendor "Bea" for product "Weblogic Server" | 8.1 Search vendor "Bea" for product "Weblogic Server" and version "8.1" | sp4, express |
Affected
| ||||||
| Bea Search vendor "Bea" | Weblogic Server Search vendor "Bea" for product "Weblogic Server" | 8.1 Search vendor "Bea" for product "Weblogic Server" and version "8.1" | sp5 |
Affected
| ||||||
| Bea Search vendor "Bea" | Weblogic Server Search vendor "Bea" for product "Weblogic Server" | 8.1 Search vendor "Bea" for product "Weblogic Server" and version "8.1" | sp5, express |
Affected
| ||||||
| Bea Search vendor "Bea" | Weblogic Server Search vendor "Bea" for product "Weblogic Server" | 8.1 Search vendor "Bea" for product "Weblogic Server" and version "8.1" | sp6 |
Affected
| ||||||
| Bea Search vendor "Bea" | Weblogic Server Search vendor "Bea" for product "Weblogic Server" | 8.1 Search vendor "Bea" for product "Weblogic Server" and version "8.1" | sp6, express |
Affected
| ||||||
| Bea Search vendor "Bea" | Weblogic Server Search vendor "Bea" for product "Weblogic Server" | 9.2 Search vendor "Bea" for product "Weblogic Server" and version "9.2" | - |
Affected
| ||||||
| Bea Search vendor "Bea" | Weblogic Server Search vendor "Bea" for product "Weblogic Server" | 9.2 Search vendor "Bea" for product "Weblogic Server" and version "9.2" | mp1 |
Affected
| ||||||
| Bea Search vendor "Bea" | Weblogic Server Search vendor "Bea" for product "Weblogic Server" | 10.0 Search vendor "Bea" for product "Weblogic Server" and version "10.0" | - |
Affected
| ||||||
| Bea Systems Search vendor "Bea Systems" | Weblogic Express Search vendor "Bea Systems" for product "Weblogic Express" | 9.2 Search vendor "Bea Systems" for product "Weblogic Express" and version "9.2" | mp1 |
Affected
| ||||||
| Bea Systems Search vendor "Bea Systems" | Weblogic Express Search vendor "Bea Systems" for product "Weblogic Express" | 10.0 Search vendor "Bea Systems" for product "Weblogic Express" and version "10.0" | - |
Affected
| ||||||