PT-2000-1437 · Bea · Bea Weblogic

CVE-2000-0499 · Publicado 2000-06-08 · Atualizado 2024-01-26

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic versions 3.1.8 through 4.5.1

Description The default configuration of the software allows a remote attacker to view the source code of a JSP program. This can be achieved by requesting a URL that provides the JSP extension in upper case.

Recommendations For BEA WebLogic versions 3.1.8 through 4.5.1, consider changing the default configuration to prevent remote attackers from viewing the source code of JSP programs. As a temporary workaround, restrict access to JSP files to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-178

Identificadores relacionados

CVE-2000-0499

Produtos afetados

Bea Weblogic

Referências · 6

• 🔥 http://securityfocus.com/bid/1328 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0499 · Nota
• http://archives.neohapsis.com/archives/ntbugtraq/2000-q2/0262.htm · Nota
• http://developer.bea.com/alerts/security_000612.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/4694 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2000-0499 · Nota de Segurança