[Forgot Password]
Login  Register Subscribe

24128

 
 

131573

 
 

110210

 
 

909

 
 

86021

 
 

136

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML view JSON

CVE-2008-3257Date: (C)2008-07-22   (M)2018-02-19


Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V3 Severity:CVSS V2 Severity:
CVSS Score : CVSS Score : 10.0
Exploit Score: Exploit Score: 10.0
Impact Score: Impact Score: 10.0
 
CVSS V3 Metrics:CVSS V2 Metrics:
Attack Vector: Access Vector: NETWORK
Attack Complexity: Access Complexity: LOW
Privileges Required: Authentication: NONE
User Interaction: Confidentiality: COMPLETE
Scope: Integrity: COMPLETE
Confidentiality: Availability: COMPLETE
Integrity:  
Availability:  
  
Reference:
SECTRACK-1020520
http://www.attrition.org/pipermail/vim/2008-July/002036.html
BID-30273
SECUNIA-31146
EXPLOIT-DB-6089
ADV-2008-2145
VU#716387
http://blogs.oracle.com/security/2008/07/security_alert_for_cve-2008-3257_released.html
http://www.oracle.com/technology/deploy/security/alerts/alert_cve2008-3257.html
https://support.bea.com/application_content/product_portlets/securityadvisories/2793.html
oracle-weblogic-apacheconnector-bo(43885)

CPE    54
cpe:/a:bea:weblogic_server:10.0
cpe:/a:bea:weblogic_server:9.2
cpe:/a:bea:weblogic_server:9.1
cpe:/a:bea:weblogic_server:4.5.2:sp1
...
CWE    1
CWE-119

© SecPod Technologies