CVE-2000-0685 BEA WebLogic 5.1.x does not properly restrict access to the PageCompileServlet, which could allow remote attackers to compile and execute Java JHTML code by directly invoking the servlet on any source...
HighCVSS 10.0
EPSS 12.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
BEA WebLogic 5.1.x does not properly restrict access to the PageCompileServlet, which could allow remote attackers to compile and execute Java JHTML code by directly invoking the servlet on any source file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bea weblogic server | = 3.1.8 | No fix listed |
| bea weblogic server | = 4.0.4 | No fix listed |
| bea weblogic server | = 4.5.1 | No fix listed |
References
- 20000731 BEA's WebLogic *.jsp/*.jhtml remote command execution mailing-list patch vendor-advisory
- developer.bea.com
- 1525 exploit patch vdb-entry vendor-advisory