CVE-2008-0870
BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 2, under certain circumstances, can...
BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 2, under certain circumstances, can redirect a user from the https:// URI for the Portal Administration Console to an http URI, which allows remote attackers to sniff the session.
Exploit likelihood
What each source reports
NVD Score used
BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 2, under certain circumstances, can redirect a user from the https:// URI for the Portal Administration Console to an http URI, which allows remote attackers to sniff the session.
- Record
CVE-2008-0870- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-59
- Updated
- 2026-11-02
CVE List No score
BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 2, under certain circumstances, can redirect a user from the https:// URI for the Portal Administration Console to an http URI, which allows remote attackers to sniff the session.
- Record
CVE-2008-0870- Updated
- 2026-11-02
EUVDEUVD-2008-0877 No score
BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 2, under certain circumstances, can redirect a user from the https:// URI for the Portal Administration Console to an http URI, which allows remote attackers to sniff the session.
- Record
EUVD-2008-0877- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xh4h-vjm3-wxmv No score
BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 2, under certain circumstances, can...
BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 2, under certain circumstances, can redirect a user from the https:// URI for the Portal Administration Console to an http URI, which allows remote attackers to sniff the session.
- Record
GHSA-xh4h-vjm3-wxmv- Weakness
- CWE-59
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-0870 is a high vulnerability (CVSS 7.5) in Bea Systems Weblogic Portal, published February 21, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.43%, the 73rd percentile. No source names a fixed version.