CVE-2000-1238

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2000-12-31 · updated 2026-09-23

Description

BEA Systems WebLogic Express and WebLogic Server 5.1 SP1-SP6 allows remote attackers to bypass access controls for restricted JSP or servlet pages via a URL with multiple / (forward slash) characters before the restricted pages.

Affected products

Bea Weblogic Server: 5.1, 5.1-sp1, 5.1-sp2, 5.1-sp3, 5.1-sp4, 5.1-sp5 (+1)

References

http://www.securityfocus.com/bid/5089
https://exchange.xforce.ibmcloud.com/vulnerabilities/5588
http://www.securityfocus.com/bid/5089
https://exchange.xforce.ibmcloud.com/vulnerabilities/5588

Get alerted when CVE-2000-1238 or the next vulnerability affects your stack