CVE-2008-0870

BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 2, under certain circumstances, can redirect a user from the https:// URI for the Portal Administration Console to an http URI, which allows remote attackers to sniff the session.
Link Following
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:P/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 52%
VendorProductVersion
bea_systemsweblogic_portal
9.2:mp1
bea_systemsweblogic_portal
9.2:mp2
bea_systemsweblogic_portal
10.0
oracleweblogic_portal
9.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://dev2dev.bea.com/pub/advisory/264
http://secunia.com/advisories/29041
http://www.securitytracker.com/id?1019442
http://www.vupen.com/english/advisories/2008/0613
http://dev2dev.bea.com/pub/advisory/264
http://secunia.com/advisories/29041
http://www.securitytracker.com/id?1019442
http://www.vupen.com/english/advisories/2008/0613