Unscored severity · published Feb 21, 2008
CVE-2008-0864
Admin Tools in BEA WebLogic Portal 8.1 SP3 through SP6 can inadvertently remove entitlements for pages when an administrator edits the page definition label, which might allow…
–
CVSS
1.8%
EPSS
No
On KEV
Description
Admin Tools in BEA WebLogic Portal 8.1 SP3 through SP6 can inadvertently remove entitlements for pages when an administrator edits the page definition label, which might allow remote attackers to bypass intended access restrictions.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WP
Weblogic Portal · Bea Systems
8.1_sp6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-0864
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-0864
dev2dev.bea.com
http://dev2dev.bea.com/pub/advisory/256
secunia.com
http://secunia.com/advisories/29041
www.securitytracker.com
http://www.securitytracker.com/id?1019454
www.vupen.com
http://www.vupen.com/english/advisories/2008/0613
More from Weblogic Portal
–
CVE-2008-0896
BEA WebLogic Portal 10.0 and 9.2 through MP1, when an administrator deletes a single instance of a content portlet, removes entitlement policies for other content portlets, which…
–
CVE-2008-0865
Unspecified vulnerability in BEA WebLogic Portal 8.1 through SP6 allows remote attackers to bypass entitlements for instances of a floatable WLP portlet via unknown vectors
–
CVE-2008-0868
Cross-site scripting (XSS) vulnerability in Groupspace in BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 1 allows remote authenticated users to inject arbitrary web…
–
CVE-2008-0870
BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 2, under certain circumstances, can redirect a user from the https:// URI for the Portal Administration Console to an…