Vulnerability in BEA Systems Weblogic Portal

CVE-2008-0864

Admin Tools in BEA WebLogic Portal 8.1 SP3 through SP6 can inadvertently remove entitlements for pages when an administrator edits the page definition label, which might allow remote attackers to bypass intended access restrictions.

EPSS: 0.018 (76.4th percentile) — read the EPSS interpretation.

Affected products

Bea_systems Weblogic_portal — versions 8.1_sp6
Oracle Weblogic_portal — versions 8.1
N/a — versions n/a

Weakness classification (CWE)

CWE-264

References

cve@mitre.org (vdb-entry, x_refsource_VUPEN)
cve@mitre.org (x_refsource_SECUNIA, third-party-advisory)
cve@mitre.org (vdb-entry, x_refsource_SECTRACK)
cve@mitre.org (vendor-advisory, x_refsource_BEA)