← Vulnerability feed

Vulnerability record · CVE-2008-0903 · published 22 February 2008

CVE-2008-0903: Bea systems weblogic express vulnerability

Bea Systems · Weblogic Express

Unspecified vulnerability in the BEA WebLogic Server and Express proxy plugin, as distributed before November 2007 and before 9.2 MP3 and 10.0 MP2, allows remote attackers to cause a denial of service (web server crash) via a crafted URL.

4.3 CVSS 2.0 Medium EPSS 1.2% · top 33.0%
4.3CVSS 2.0 base score
1.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
8References
16 Jun 2026Last modified by NVD

Description

Unspecified vulnerability in the BEA WebLogic Server and Express proxy plugin, as distributed before November 2007 and before 9.2 MP3 and 10.0 MP2, allows remote attackers to cause a denial of service (web server crash) via a crafted URL.

AV:N/AC:M/Au:N/C:N/I:N/A:P

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://dev2dev.bea.com/pub/advisory/275 Patch
http://secunia.com/advisories/29041
http://www.securitytracker.com/id?1019450
http://www.vupen.com/english/advisories/2008/0608/references
http://dev2dev.bea.com/pub/advisory/275 Patch
http://secunia.com/advisories/29041
http://www.securitytracker.com/id?1019450
http://www.vupen.com/english/advisories/2008/0608/references

Track CVE-2008-0903 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2008-3257WebLogic Apache Connector mod_wl stack buffer overflow via HTTP version stringThe Apache Connector (mod_wl) in Oracle WebLogic Server 10.3 and earlier has a stack-based buffer overflow reachable through a long HTTP version stri…EPSS 84%analysed7.1CVE-2008-0901Bea weblogic server information exposure vulnerabilityBEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout …EPSS 2.2%6.4CVE-2010-2375Bea weblogic server vulnerabilityPackage/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware…EPSS 6.5%6.0CVE-2008-0900Bea weblogic server permissions and access controls vulnerabilitySession fixation vulnerability in BEA WebLogic Server and Express 8.1 SP4 through SP6, 9.2 through MP1, and 10.0 allows remote authenticated users to…EPSS 10.0%4.3CVE-2008-0902Bea weblogic server cross-site scripting vulnerabilityMultiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 6.1 through 10.0 MP1 allow remote attackers to inject arbitrar…EPSS 1.0%

Source: NIST National Vulnerability Database (record CVE-2008-0903), CISA KEV, FIRST EPSS (scores of 2026-10-09). This page is refreshed as NVD updates the record.