CVE-2000-0500: Medium severity Bea WebLogic Server vulnerability

Published Jun 21, 2000

Updated

The default configuration of BEA WebLogic 5.1.0 allows a remote attacker to view source code of programs by requesting a URL beginning with /file/, which causes the default servlet to display the file without further processing.

Affected Software

8 affected components

Bea WebLogic Server=5.1

Bea WebLogic Server=3.1.8

Bea WebLogic Server=4.5

Bea WebLogic Server=5.1

Bea WebLogic Server=4.0

Bea WebLogic Server=3.1.8

Bea WebLogic Server=4.0

Remediation

Patch Available

http://www.securityfocus.com/bid/1378

Event History

Jun 21, 2000

CVE Published

04:00 AM

Oct 13, 2000

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2000-0500?

CVE-2000-0500 is considered a significant vulnerability due to its potential to expose sensitive source code to remote attackers.

How do I fix CVE-2000-0500?

To fix CVE-2000-0500, ensure that the default configuration of BEA WebLogic is modified to restrict access to the /file/ directory.

What software versions are affected by CVE-2000-0500?

CVE-2000-0500 affects multiple versions of BEA WebLogic Server, including versions 3.1.8, 4.0, 4.5, and 5.1.

Can CVE-2000-0500 lead to data exposure?

Yes, CVE-2000-0500 can lead to data exposure as it allows attackers to view the source code of applications.

Is there a known exploit for CVE-2000-0500?

Yes, there are known exploits for CVE-2000-0500 that leverage the vulnerability to access source code without authorization.