« Back to list

CVE-2008-4008

Status: ModifiedHigh (10)—

Unspecified vulnerability in the WebLogic Server Plugins for Apache component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, 7.0 SP7, and 6.1 SP7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2008 CPU. Oracle has not commented on reliable researcher claims that this issue is a stack-based buffer overflow in the WebLogic Apache Connector, related to an invalid parameter.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Oracle — BEA Product Suite

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2008-4008",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": true,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert_us@oracle.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-10-14T21:11:11.487",
  "references": [
    {
      "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=751",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2008-100299.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://www.securitytracker.com/id?1021056",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/2825",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=751",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2008-100299.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id?1021056",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/2825",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unspecified vulnerability in the WebLogic Server Plugins for Apache component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, 7.0 SP7, and 6.1 SP7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2008 CPU. Oracle has not commented on reliable researcher claims that this issue is a stack-based buffer overflow in the WebLogic Apache Connector, related to an invalid parameter."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad sin especificar en el plugin de WebLogic Server para el componente Apache del BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, 7.0 SP7, y 6.1 SP7 permite afectar la confidencialidad, integridad y disponibilidad a atacantes remotos a través de vectores desconocidos."
    }
  ],
  "lastModified": "2026-06-16T22:56:59.133",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:bea_product_suite:6.1:sp7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4CDF7FE1-3DB4-4C59-8B6C-1541CC552CC4"
            },
            {
              "criteria": "cpe:2.3:a:oracle:bea_product_suite:7.0:sp7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6859E096-4FA7-4797-B2D6-C5CE15D2078C"
            },
            {
              "criteria": "cpe:2.3:a:oracle:bea_product_suite:8.1:sp6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0B8AB045-051A-477E-B2F7-4057826C43F1"
            },
            {
              "criteria": "cpe:2.3:a:oracle:bea_product_suite:9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6B5D9ABA-10EE-4EE2-9814-BDFBBE9A6014"
            },
            {
              "criteria": "cpe:2.3:a:oracle:bea_product_suite:9.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "09215858-8A4F-4595-98DD-39027EC6CC1A"
            },
            {
              "criteria": "cpe:2.3:a:oracle:bea_product_suite:9.2:mp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A7390B6A-7944-4509-B499-5B51DB9BF42E"
            },
            {
              "criteria": "cpe:2.3:a:oracle:bea_product_suite:10.0:mp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "193516AD-8096-4A6E-9C4B-4B9717DD7021"
            },
            {
              "criteria": "cpe:2.3:a:oracle:bea_product_suite:10.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2B1C64BD-7C8C-4B28-9EA8-5198B6C71AD1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com"
}