HIGH🇵🇱 Wersja polska

CVE-2008-3257

CVSS 10.0v2.0pub. 2008-07-22upd. 2026-04-23

Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request.

CVSS Vector
AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Bea Weblogic Server

    APP
    Bea
    10.03.1.84.04.0.44.54.5.14.5.25.16.06.17.07.0.0.18.19.09.1+ 1 more

  • Bea Systems Apache Connector In Weblogic Server

    APP
    Bea Systems
    all versions

  • Bea Systems Weblogic Server

    APP
    Bea Systems
    10.0_mp1

  • Oracle Weblogic Server

    APP
    Oracle
    ≤ 10.3
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCEMemory
CWE
References

Related vulnerabilities

CVE-2022-22965CRITICAL9.8⚠ KEVPL ✓same product

Spring4Shell — RCE przez data binding w Spring MVC/WebFlux na JDK 9+

CVE-2020-14750CRITICAL9.8⚠ KEVPL ✓same product

Oracle WebLogic Server — Auth Bypass w komponencie Console (RCE)

CVE-2020-14882CRITICAL9.8⚠ KEVPL ✓same product

RCE bez uwierzytelnienia w konsoli Oracle WebLogic Server

CVE-2020-14644CRITICAL9.8⚠ KEVPL ✓same product

RCE w Oracle WebLogic Server — przejęcie serwera przez IIOP/T3

CVE-2020-2883CRITICAL9.8⚠ KEVPL ✓same product

RCE w Oracle WebLogic Server przez protokoły IIOP/T3 (bez uwierzytelnienia)