Vulnerability CVE-2008-0864
Published: 2008-02-20   Modified: 2012-02-12

Description:
Admin Tools in BEA WebLogic Portal 8.1 SP3 through SP6 can inadvertently remove entitlements for pages when an administrator edits the page definition label, which might allow remote attackers to bypass intended access restrictions.

Type:

CWE-264

 (Permissions, Privileges, and Access Controls)

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5/10
2.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None
Affected software
Oracle -> Weblogic portal 
Bea systems -> Weblogic portal 
BEA -> Weblogic portal 

 References:
http://dev2dev.bea.com/pub/advisory/256
http://www.securitytracker.com/id?1019454
http://www.vupen.com/english/advisories/2008/0613
Copyright 2024, cxsecurity.com

 

Back to Top