CVE:CVE-2008-0901
CNNVD:CNNVD-200802-418
BEA WebLogic Server和 Express 7.0至10.0会允许远程攻击者即使在账户锁定被激活时，通过精心设计的 URLs来推测密码是否成功来进行密码猜测攻击。
solution:Upgrade bea weblogic_server to a higher version than 7.0,7.0:sp1,7.0:sp2,7.0:sp3,7.0:sp4,7.0:sp5,7.0:sp6,7.0:sp7,8.1,8.1:sp1,8.1:sp2,8.1:sp3,8.1:sp4,8.1:sp5,8.1:sp6,9.0,9.1,9.2,9.2:mp1,9.2:mp2,10.0,and avoid the version 7.0,7.0:sp1,7.0:sp2,7.0:sp3,7.0:sp4,7.0:sp5,7.0:sp6,7.0:sp7,8.1,8.1:sp1,8.1:sp2,8.1:sp3,8.1:sp4,8.1:sp5,8.1:sp6,9.0,9.1,9.2,9.2:mp1,9.2:mp2,10.0; Upgrade bea_systems weblogic_server to a higher version than 10.0_mp1,and avoid the version 10.0_mp1