« Volver al listado

CVE-2000-1238

Estado: ModificadaAlta (7.5)—

BEA Systems WebLogic Express y WebLogic Server 5.1 SP1-SP6 permite a atacantes remotos eludir los controles de acceso para páginas JSP o servlet restringidas a través de una URL con múltiples caracteres / (barra diagonal) antes de las páginas restringidas.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

BEA — Weblogic Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2000-1238",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2000-12-31T05:00:00.000",
  "references": [
    {
      "url": "ftp://ftpna.bea.com/pub/releases/patches/SecurityBEA00-0600.zip",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/5089",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/5588",
      "source": "cve@mitre.org"
    },
    {
      "url": "ftp://ftpna.bea.com/pub/releases/patches/SecurityBEA00-0600.zip",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/5089",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/5588",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "BEA Systems WebLogic Express and WebLogic Server 5.1 SP1-SP6 allows remote attackers to bypass access controls for restricted JSP or servlet pages via a URL with multiple / (forward slash) characters before the restricted pages."
    },
    {
      "lang": "es",
      "value": "BEA Systems WebLogic Express y WebLogic Server 5.1 SP1-SP6 permite a atacantes remotos eludir los controles de acceso para páginas JSP o servlet restringidas a través de una URL con múltiples caracteres / (barra diagonal) antes de las páginas restringidas."
    }
  ],
  "lastModified": "2026-09-23T09:10:01.707",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:bea:weblogic_server:5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CCD5D4AD-0BA3-42F7-852F-524488D74A96"
            },
            {
              "criteria": "cpe:2.3:a:bea:weblogic_server:5.1:*:express:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A8F69E7A-8BBB-4D20-AEE9-F37155AD5C3F"
            },
            {
              "criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2B393A66-08A6-4EBA-B01E-BB6418423F79"
            },
            {
              "criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp1:express:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0FAB4F19-EFE0-4860-B9E9-E3938A36AE17"
            },
            {
              "criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "99D0A3A8-1444-4DA4-AEF3-08578482574C"
            },
            {
              "criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp2:express:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8B0B183B-95A3-463D-B76B-50640F554013"
            },
            {
              "criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "523836A4-0110-4CD3-A81E-988A02AEA68C"
            },
            {
              "criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp3:express:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "36A0EFDA-409E-44F0-9F8B-167A72D2361B"
            },
            {
              "criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A705EB67-3961-445F-8023-F82C7618BE2B"
            },
            {
              "criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp4:express:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "51A8AB95-FB23-4A7A-A6F5-EF442EAABD26"
            },
            {
              "criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BD698DD8-5491-4A73-A527-8C9228992A2D"
            },
            {
              "criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp5:express:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5F00947F-1804-41D5-8F2B-7E48C77B1306"
            },
            {
              "criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "86C4679F-F13F-4A97-AE42-BC54BD0F149C"
            },
            {
              "criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp6:express:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "114E5E3E-84B2-4DD3-98FC-2ABFFA41BAD4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "evaluatorSolution": "This vulnerability is addressed in the following product releases:\r\nBEA Systems Weblogic Server 5.1 SP 7\r\nBEA Systems WebLogic Express 5.1 SP 7"
}