PT-2000-2017 · Bea Systems · Oracle Weblogic Server+1

Published 2000-12-31 · Updated 2017-07-11 · CVE-2000-1238

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BEA Systems WebLogic Express and WebLogic Server versions 5.1 SP1 through 5.1 SP6

Description The issue allows remote attackers to bypass access controls for restricted JSP or servlet pages by using a URL with multiple / (forward slash) characters before the restricted pages.

Recommendations For versions 5.1 SP1 through 5.1 SP6, consider restricting access to sensitive JSP or servlet pages until a fix is available. As a temporary workaround, review and modify URL handling mechanisms to prevent bypassing of access controls via multiple / characters.

Fix

Related Identifiers

CVE-2000-1238

Affected Products

Weblogic Express

Oracle Weblogic Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2000-1238 · Security Note
• ftp://ftpna.bea.com/pub/releases/patches/SecurityBEA00-0600.zip · Patch
• http://securityfocus.com/bid/5089 · Patch
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-1238 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/5588 · Note