Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2008-4008

4 documents4 sources

Severity

10.0CRITICAL

EPSS

85.8%

top 0.62%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Oracle BEA Product Suite

Timeline

PublishedOct 14

Latest updateMay 2

Description

Unspecified vulnerability in the WebLogic Server Plugins for Apache component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, 7.0 SP7, and 6.1 SP7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2008 CPU. Oracle has not commented on reliable researcher claims that this issue is a stack-based buffer overflow in the WebLogic Apache Connector, related to an invalid param…

CVSS vector

AV:N/AC:L/C:C/I:C/A:CExploitability: 10.0 | Impact: 10.0

Affected Packages1 packages

▶NVDoracle/bea_product_suite8 versions+7

🔴Vulnerability Details

GHSA

GHSA-xr79-9mqh-j474: Unspecified vulnerability in the WebLogic Server Plugins for Apache component in BEA Product Suite 10↗2022-05-02

▶

CVEList

CVE-2008-4008: Unspecified vulnerability in the WebLogic Server Plugins for Apache component in BEA Product Suite 10↗2008-10-14

▶

💥Exploits & PoCs

Exploit-DB

BEA Weblogic - Transfer-Encoding Buffer Overflow (Metasploit)↗2010-07-08

▶