PT-2000-1438 · Bea · Bea Weblogic

Published 2000-06-21 · Updated 2017-10-10 · CVE-2000-0500

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions BEA WebLogic version 5.1.0

Description The default configuration of the software allows a remote attacker to view the source code of programs by requesting a URL beginning with "/file/", which causes the default servlet to display the file without further processing.

Recommendations For BEA WebLogic version 5.1.0, consider reconfiguring the default servlet to prevent it from displaying files without further processing, or restrict access to the "/file/" URL to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2000-0500

Affected Products

Bea Weblogic

References · 7

• 🔥 http://securityfocus.com/bid/1378 · Exploit
• 🔥 https://exploit-db.com/exploits/20027 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2000-0500 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/4775 · Note
• http://marc.info/?l=bugtraq&m=96161462915381&w=2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0500 · Note
• http://weblogic.com/docs51/admindocs/http.html#file · Note