PT-2000-2017 · Bea Systems · Oracle Weblogic Server+1

Publicado 2000-12-31 · Atualizado 2017-07-11 · CVE-2000-1238

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BEA Systems WebLogic Express and WebLogic Server versions 5.1 SP1 through 5.1 SP6

Description The issue allows remote attackers to bypass access controls for restricted JSP or servlet pages by using a URL with multiple / (forward slash) characters before the restricted pages.

Recommendations For versions 5.1 SP1 through 5.1 SP6, consider restricting access to sensitive JSP or servlet pages until a fix is available. As a temporary workaround, review and modify URL handling mechanisms to prevent bypassing of access controls via multiple / characters.

Correção

Identificadores relacionados

CVE-2000-1238

Produtos afetados

Weblogic Express

Oracle Weblogic Server

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2000-1238 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-1238 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/5588 · Nota
• ftp://ftpna.bea.com/pub/releases/patches/SecurityBEA00-0600.zip · Correção
• http://securityfocus.com/bid/5089 · Correção