CVE-2008-0901

Description

BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not.

References

https://euvd.enisa.europa.eu/vulnerability/EUVD-2008-0908

http://www.vupen.com/english/advisories/2008/0612/references

http://www.securitytracker.com/id?1019449

http://www.securityfocus.com/archive/1/488686/100/0/threaded

http://www.s21sec.com/avisos/s21sec-040-en.txt

http://secunia.com/advisories/29041

http://dev2dev.bea.com/pub/advisory/271

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS