PT-2000-1438 · Bea · Bea Weblogic

Publicado 2000-06-21 · Atualizado 2017-10-10 · CVE-2000-0500

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic version 5.1.0

Description The default configuration of the software allows a remote attacker to view the source code of programs by requesting a URL beginning with "/file/", which causes the default servlet to display the file without further processing.

Recommendations For BEA WebLogic version 5.1.0, consider reconfiguring the default servlet to prevent it from displaying files without further processing, or restrict access to the "/file/" URL to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2000-0500

Produtos afetados

Bea Weblogic

Referências · 7

• 🔥 http://securityfocus.com/bid/1378 · Exploit
• 🔥 https://exploit-db.com/exploits/20027 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/4775 · Nota
• http://marc.info/?l=bugtraq&m=96161462915381&w=2 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0500 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2000-0500 · Nota de Segurança
• http://weblogic.com/docs51/admindocs/http.html#file · Nota