BEA WebLogic < 5.1 SP 11 JSP Source Disclosure

medium Nessus Network Monitor Plugin ID 1538

Synopsis

The remote WebLogic server may be tricked into revealing the source code of JSP scripts by prefixing their path by '/*.shtml/'.

Description

The remote WebLogic server may be tricked into revealing the source code of JSP scripts by prefixing their path by '/*.shtml/'.

Solution

Upgrade to version 5.1 SP 11 or higher.

Plugin Details

Severity: Medium

ID: 1538

Family: Web Servers

Published: 8/18/2004

Updated: 3/6/2019

Nessus ID: 11604

Risk Information

VPR

Risk Factor: Low

Score: 3.4

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:H/RL:U/RC:X

Vulnerability Information

CPE: cpe:/a:bea:weblogic_server

Reference Information

CVE: CVE-2000-0683

BID: 1517

Detections

Analytics