CVE-2008-0900: Bea WebLogic Server

Medium severity, CVSS 6.0. EPSS: 10% chance of exploitation in the next 30 days.

Session fixation vulnerability in BEA WebLogic Server and Express 8.1 SP4 through SP6, 9.2 through MP1, and 10.0 allows remote authenticated users to hijack web sessions via unknown vectors.

Affected products

• Bea WebLogic Server: version 8.1 only; version 9.2 only; version 10.0 only
• Bea Systems WebLogic Express: version 9.2 only; version 10.0 only

Published 2008-02-22. Last modified 2026-06-16.