CVE-2008-3257

Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request.

• CWE-119

• http://blogs.oracle.com/security/2008/07/security_alert_for_cve-2008-3257_released.html
• http://secunia.com/advisories/31146Vendor Advisory
• http://www.attrition.org/pipermail/vim/2008-July/002035.html
• http://www.attrition.org/pipermail/vim/2008-July/002036.html
• http://www.kb.cert.org/vuls/id/716387US Government Resource
• http://www.oracle.com/technology/deploy/security/alerts/alert_cve2008-3257.html
• http://www.securityfocus.com/bid/30273
• http://www.securitytracker.com/id?1020520
• http://www.vupen.com/english/advisories/2008/2145/references
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43885
• https://support.bea.com/application_content/product_portlets/securityadvisories/2793.html
• https://www.exploit-db.com/exploits/6089
• http://blogs.oracle.com/security/2008/07/security_alert_for_cve-2008-3257_released.html
• http://secunia.com/advisories/31146Vendor Advisory
• http://www.attrition.org/pipermail/vim/2008-July/002035.html
• http://www.attrition.org/pipermail/vim/2008-July/002036.html
• http://www.kb.cert.org/vuls/id/716387US Government Resource
• http://www.oracle.com/technology/deploy/security/alerts/alert_cve2008-3257.html
• http://www.securityfocus.com/bid/30273
• http://www.securitytracker.com/id?1020520
• http://www.vupen.com/english/advisories/2008/2145/references
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43885
• https://support.bea.com/application_content/product_portlets/securityadvisories/2793.html
• https://www.exploit-db.com/exploits/6089

Published

Jul 22, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-3251Multiple SQL injection vulnerabilities in tplSoccerSite 1.0 …
• CVE-2008-3252Stack-based buffer overflow in the read_article function in …
• CVE-2008-3253Cross-site scripting (XSS) vulnerability in the XenAPI HTTP …
• CVE-2008-3254SQL injection vulnerability in index.php in preCMS 1 allows …
• CVE-2008-3255Cross-site scripting (XSS) vulnerability in LunarNight Labor…
• CVE-2008-3256SQL injection vulnerability in folder.php in Siteframe CMS 3…
• CVE-2008-3258Multiple SQL injection vulnerabilities in Zoph before 0.7.0.…
• CVE-2008-3259OpenSSH before 5.1 sets the SO_REUSEADDR socket option when …
• CVE-2008-3260Multiple cross-site scripting (XSS) vulnerabilities in Claro…
• CVE-2008-3261Open redirect vulnerability in claroline/redirector.php in C…
• CVE-2008-3262Cross-site request forgery (CSRF) vulnerability in Claroline…
• CVE-2008-3263The IAX2 protocol implementation in Asterisk Open Source 1.0…