Vulnerability Details : CVE-2008-4008
Public exploit exists!
Unspecified vulnerability in the WebLogic Server Plugins for Apache component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, 7.0 SP7, and 6.1 SP7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2008 CPU. Oracle has not commented on reliable researcher claims that this issue is a stack-based buffer overflow in the WebLogic Apache Connector, related to an invalid parameter.
Vulnerability category: Overflow
Products affected by CVE-2008-4008
- cpe:2.3:a:oracle:bea_product_suite:10.0:mp1:*:*:*:*:*:*
- cpe:2.3:a:oracle:bea_product_suite:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:bea_product_suite:9.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:bea_product_suite:9.2:mp3:*:*:*:*:*:*
- cpe:2.3:a:oracle:bea_product_suite:7.0:sp7:*:*:*:*:*:*
- cpe:2.3:a:oracle:bea_product_suite:8.1:sp6:*:*:*:*:*:*
- cpe:2.3:a:oracle:bea_product_suite:6.1:sp7:*:*:*:*:*:*
- cpe:2.3:a:oracle:bea_product_suite:10.3:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2008-4008
97.01%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 100 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2008-4008
-
BEA Weblogic Transfer-Encoding Buffer Overflow
Disclosure Date: 2008-09-09First seen: 2020-04-26exploit/windows/http/bea_weblogic_transfer_encodingThis module exploits a stack based buffer overflow in the BEA Weblogic Apache plugin. This vulnerability exists in the error reporting for unknown Transfer-Encoding headers. You may have to run this twice due to timing issues with handlers. Authors: - pus
CVSS scores for CVE-2008-4008
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST |
References for CVE-2008-4008
Jump to