{"api_version":"1","generated_at":"2026-04-23T05:04:52+00:00","cve":"CVE-2008-0899","urls":{"html":"https://cve.report/CVE-2008-0899","api":"https://cve.report/api/cve/CVE-2008-0899.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-0899","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-0899"},"summary":{"title":"CVE-2008-0899","description":"Cross-site scripting (XSS) vulnerability in the Administration Console in BEA WebLogic Server and Express 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via URLs that are not properly handled by the Unexpected Exception Page.","state":"PUBLISHED","assigner":"mitre","published_at":"2008-02-22 21:44:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://dev2dev.bea.com/pub/advisory/269","name":"http://dev2dev.bea.com/pub/advisory/269","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"Oracle Fusion Middleware Technologies","mime":"text/html","httpstatus":"200","archivestatus":"406"},{"url":"http://www.vupen.com/english/advisories/2008/0612/references","name":"http://www.vupen.com/english/advisories/2008/0612/references","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"inode/x-empty","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/29041","name":"http://secunia.com/advisories/29041","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"About Secunia Research | Flexera","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id?1019448","name":"http://www.securitytracker.com/id?1019448","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"WebLogic Server Administration Console Input Validation Hole Permits Cross-Site Scripting Attacks - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-0899","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-0899","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"899","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"bea","cpe5":"weblogic_server","cpe6":"10.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"899","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"bea","cpe5":"weblogic_server","cpe6":"9.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"899","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"bea","cpe5":"weblogic_server","cpe6":"9.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"899","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"bea","cpe5":"weblogic_server","cpe6":"9.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"899","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"bea","cpe5":"weblogic_server","cpe6":"9.2","cpe7":"mp1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T08:01:40.102Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"1019448","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id?1019448"},{"name":"29041","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/29041"},{"name":"ADV-2008-0612","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2008/0612/references"},{"name":"BEA08-195.00","tags":["vendor-advisory","x_refsource_BEA","x_transferred"],"url":"http://dev2dev.bea.com/pub/advisory/269"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-02-19T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in the Administration Console in BEA WebLogic Server and Express 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via URLs that are not properly handled by the Unexpected Exception Page."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2008-03-11T09:00:00.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"1019448","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id?1019448"},{"name":"29041","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/29041"},{"name":"ADV-2008-0612","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2008/0612/references"},{"name":"BEA08-195.00","tags":["vendor-advisory","x_refsource_BEA"],"url":"http://dev2dev.bea.com/pub/advisory/269"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-0899","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in the Administration Console in BEA WebLogic Server and Express 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via URLs that are not properly handled by the Unexpected Exception Page."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"1019448","refsource":"SECTRACK","url":"http://www.securitytracker.com/id?1019448"},{"name":"29041","refsource":"SECUNIA","url":"http://secunia.com/advisories/29041"},{"name":"ADV-2008-0612","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2008/0612/references"},{"name":"BEA08-195.00","refsource":"BEA","url":"http://dev2dev.bea.com/pub/advisory/269"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-0899","datePublished":"2008-02-22T21:00:00.000Z","dateReserved":"2008-02-22T00:00:00.000Z","dateUpdated":"2024-08-07T08:01:40.102Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2008-02-22 21:44:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*","matchCriteriaId":"3CA97F1A-49F7-4511-8959-D62155491DF5"},{"vulnerable":true,"criteria":"cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*","matchCriteriaId":"DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6"},{"vulnerable":true,"criteria":"cpe:2.3:a:bea:weblogic_server:9.2:*:*:*:*:*:*:*","matchCriteriaId":"7BA8C449-ECD0-46E5-A7D6-740DE8DEE0EC"},{"vulnerable":true,"criteria":"cpe:2.3:a:bea:weblogic_server:9.2:mp1:*:*:*:*:*:*","matchCriteriaId":"321BC193-5FBF-4F25-996D-1FE74779F34D"},{"vulnerable":true,"criteria":"cpe:2.3:a:bea:weblogic_server:10.0:*:*:*:*:*:*:*","matchCriteriaId":"60F9ABCC-5217-4650-8C71-F8B0EB86789F"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"899","Ordinal":"1","Title":"CVE-2008-0899","CVE":"CVE-2008-0899","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"899","Ordinal":"1","NoteData":"Cross-site scripting (XSS) vulnerability in the Administration Console in BEA WebLogic Server and Express 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via URLs that are not properly handled by the Unexpected Exception Page.","Type":"Description","Title":"CVE-2008-0899"},{"CveYear":"2008","CveId":"899","Ordinal":"2","NoteData":"2008-02-22","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"899","Ordinal":"3","NoteData":"2008-03-11","Type":"Other","Title":"Modified"}]}}}