CVE-2008-0901: Bea WebLogic Server

High severity, CVSS 7.1. EPSS: 2.2% chance of exploitation in the next 30 days.

BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not.

Affected products

• Bea WebLogic Server: version 7.0 only; version 8.1 only; version 9.0 only; version 9.1 only; version 9.2 only; version 10.0 only
• Bea Systems WebLogic Server: version 10.0_mp1 only

Published 2008-02-22. Last modified 2026-06-16.