Unrated severityNVD Advisory· Published Jul 22, 2008· Updated Apr 23, 2026
CVE-2008-3257
CVE-2008-3257
Description
Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request.
Affected products
72- cpe:2.3:a:bea_systems:apache_connector_in_weblogic_server:*:*:*:*:*:*:*:*
cpe:2.3:a:bea_systems:weblogic_server:10.0_mp1:*:*:*:*:*:*:*+ 69 more
- cpe:2.3:a:bea_systems:weblogic_server:10.0_mp1:*:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:10.0:*:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:3.1.8:*:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:4.0:*:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:4.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:4.5:*:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:4.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:4.5.1:sp15:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:4.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:4.5.2:sp1:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:4.5.2:sp2:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:5.1:*:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:5.1:sp1:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:5.1:sp10:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:5.1:sp11:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:5.1:sp12:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:5.1:sp13:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:5.1:sp2:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:5.1:sp3:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:5.1:sp4:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:5.1:sp5:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:5.1:sp6:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:5.1:sp7:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:5.1:sp8:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:5.1:sp9:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:6.0:sp1:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:6.0:sp2:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:6.0:sp6:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:6.1:sp8:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp3:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp4:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:7.0:sp7:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:8.1:sp6:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:9.0:ga:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:9.0:sp1:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:9.0:sp2:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:9.0:sp3:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:9.0:sp4:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:9.0:sp5:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:9.1:ga:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:9.2:*:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:9.2:mp1:*:*:*:*:*:*
- cpe:2.3:a:bea:weblogic_server:9.2:mp2:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
12- secunia.com/advisories/31146nvdVendor Advisory
- www.kb.cert.org/vuls/id/716387nvdUS Government Resource
- blogs.oracle.com/security/2008/07/security_alert_for_cve-2008-3257_released.htmlnvd
- www.attrition.org/pipermail/vim/2008-July/002035.htmlnvd
- www.attrition.org/pipermail/vim/2008-July/002036.htmlnvd
- www.oracle.com/technology/deploy/security/alerts/alert_cve2008-3257.htmlnvd
- www.securityfocus.com/bid/30273nvd
- www.securitytracker.com/idnvd
- www.vupen.com/english/advisories/2008/2145/referencesnvd
- exchange.xforce.ibmcloud.com/vulnerabilities/43885nvd
- support.bea.com/application_content/product_portlets/securityadvisories/2793.htmlnvd
- www.exploit-db.com/exploits/6089nvd
News mentions
0No linked articles in our index yet.