What’s Vulnerable › Vulnerabilities

CVE-2008-0901

• Severity: high (CVSS 7.1 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2008-02-22 · updated 2026-06-16
• Weakness: CWE-200

Description

BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not.

Affected products

• Bea Weblogic Server: 7.0, 7.0-sp1, 7.0-sp2, 7.0-sp3, 7.0-sp4, 7.0-sp5 (+15)
• Bea Systems Weblogic Server: 10.0_mp1

References

• http://dev2dev.bea.com/pub/advisory/271
• http://secunia.com/advisories/29041
• http://www.s21sec.com/avisos/s21sec-040-en.txt
• http://www.securityfocus.com/archive/1/488686/100/0/threaded
• http://www.securitytracker.com/id?1019449
• http://www.vupen.com/english/advisories/2008/0612/references
• http://dev2dev.bea.com/pub/advisory/271
• http://secunia.com/advisories/29041
• http://www.s21sec.com/avisos/s21sec-040-en.txt
• http://www.securityfocus.com/archive/1/488686/100/0/threaded
• http://www.securitytracker.com/id?1019449
• http://www.vupen.com/english/advisories/2008/0612/references

Get alerted when CVE-2008-0901 or the next vulnerability affects your stack