CVE:CVE-2008-0900
CNNVD:CNNVD-200802-417
BEA WebLogic Server 和 Express存在固定会话漏洞。远程授权用户可以通过未知向量来劫持web会话。
solution:Upgrade bea weblogic_server to a higher version than 8.1:sp4,8.1:sp5,8.1:sp6,9.2,9.2:mp1,10.0,and avoid the version 8.1:sp4,8.1:sp5,8.1:sp6,9.2,9.2:mp1,10.0; Upgrade bea_systems weblogic_express to a higher version than 9.2:mp1,10.0,and avoid the version 9.2:mp1,10.0