CVE-2000-0684 BEA WebLogic 5.1.x does not properly restrict access to the JSPServlet, which could allow remote attackers to compile and execute Java JSP code by directly invoking the servlet on any source file.
HighCVSS 10.0
EPSS 12.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
BEA WebLogic 5.1.x does not properly restrict access to the JSPServlet, which could allow remote attackers to compile and execute Java JSP code by directly invoking the servlet on any source file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bea weblogic server | = 3.1.8 | No fix listed |
| bea weblogic server | = 4.0.4 | No fix listed |
| bea weblogic server | = 4.5.1 | No fix listed |
References
- 20000731 BEA's WebLogic *.jsp/*.jhtml remote command execution mailing-list patch vendor-advisory
- developer.bea.com
- 1525 exploit patch vdb-entry vendor-advisory