CVE-2008-0870: bea_systems weblogic_portal Link Following

Vulnerability summary

CVE-2008-0870 is a high (CVSS 7.5) Link Following vulnerability in bea_systems weblogic_portal. EPSS estimates a 1.43% chance of exploitation in the next 30 days, higher than 72.7% of scored vulnerabilities.

Timeline

1. 21-02-2008
   PublishedVulnerability first disclosed.
2. 07-08-2024
   Last modifiedVulnerability information updated.

Description

BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 2, under certain circumstances, can redirect a user from the https:// URI for the Portal Administration Console to an http URI, which allows remote attackers to sniff the session.

• CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.