6.4

CVE-2008-0895

BEA WebLogic Server and WebLogic Express 6.1 through 10.0 allows remote attackers to bypass authentication for application servlets via crafted request headers.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Bea ≫ Weblogic Server Version 6.1
Bea ≫ Weblogic Server Version 6.1 Update sp1
Bea ≫ Weblogic Server Version 6.1 Update sp2
Bea ≫ Weblogic Server Version 6.1 Update sp3
Bea ≫ Weblogic Server Version 6.1 Update sp4
Bea ≫ Weblogic Server Version 6.1 Update sp5
Bea ≫ Weblogic Server Version 6.1 Update sp6
Bea ≫ Weblogic Server Version 6.1 Update sp7
Bea ≫ Weblogic Server Version 7.0
Bea ≫ Weblogic Server Version 7.0 Update sp1
Bea ≫ Weblogic Server Version 7.0 Update sp2
Bea ≫ Weblogic Server Version 7.0 Update sp3
Bea ≫ Weblogic Server Version 7.0 Update sp4
Bea ≫ Weblogic Server Version 7.0 Update sp5
Bea ≫ Weblogic Server Version 7.0 Update sp6
Bea ≫ Weblogic Server Version 7.0 Update sp7
Bea ≫ Weblogic Server Version 8.1
Bea ≫ Weblogic Server Version 8.1 Update sp1
Bea ≫ Weblogic Server Version 8.1 Update sp2
Bea ≫ Weblogic Server Version 8.1 Update sp3
Bea ≫ Weblogic Server Version 8.1 Update sp4
Bea ≫ Weblogic Server Version 8.1 Update sp5
Bea ≫ Weblogic Server Version 8.1 Update sp6
Bea ≫ Weblogic Server Version 9.0
Bea ≫ Weblogic Server Version 9.1
Bea ≫ Weblogic Server Version 9.2
Bea ≫ Weblogic Server Version 10.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.16% 0.799
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.4 10 4.9
AV:N/AC:L/Au:N/C:P/I:P/A:N
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

http://secunia.com/advisories/29041
http://www.vupen.com/english/advisories/2008/0612/references
http://dev2dev.bea.com/pub/advisory/265
Patch
http://www.securitytracker.com/id?1019443