VULNERABILITY INTELLIGENCE

CVE-2008-0901

CVSS score7.1 HIGH
EPSS probability2.24%
CISA KEVNot currently listed
Published2008-02-22
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:N/C:C/I:N/A:N

Description

BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not.

Weakness classification

  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Primary references