CVE-2003-0151

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2003-03-24 · updated 2026-06-16

Description

BEA WebLogic Server and Express 6.0 through 7.0 does not properly restrict access to certain internal servlets that perform administrative functions, which allows remote attackers to read arbitrary files or execute arbitrary code.

Affected products

Bea Weblogic Server: 6.0, 6.0-sp1, 6.0-sp2, 6.1, 6.1-sp1, 6.1-sp2 (+8)

References

http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-28.jsp
http://marc.info/?l=bugtraq&m=104792477914620&w=2
http://marc.info/?l=bugtraq&m=104792544515384&w=2
http://www.s21sec.com/en/avisos/s21sec-011-en.txt
http://www.securityfocus.com/bid/7122
http://www.securityfocus.com/bid/7124
http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-28.jsp
http://marc.info/?l=bugtraq&m=104792477914620&w=2
http://marc.info/?l=bugtraq&m=104792544515384&w=2
http://www.s21sec.com/en/avisos/s21sec-011-en.txt
http://www.securityfocus.com/bid/7122
http://www.securityfocus.com/bid/7124

Get alerted when CVE-2003-0151 or the next vulnerability affects your stack