CVE-2002-2142

BEA WebLogic Server and Express - Unauthenticated Role Mapping Bypass via Servlet URL Pattern Handling

Title source: llm

Description

An undocumented extension for the Servlet mappings in the Servlet 2.3 specification, when upgrading to WebLogic Server and Express 7.0 Service Pack 1 from BEA WebLogic Server and Express 6.0 through 7.0.0.1, does not prepend a "/" character in certain URL patterns, which prevents the proper enforcement of role mappings and policies in applications that use the extension.

References (3)

Core 3

Core References

Third Party Advisory vdb-entry x_refsource_xf

http://www.iss.net/security_center/static/10392.php

Patch vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/5971

Vendor Advisory vendor-advisory x_refsource_bea

http://dev2dev.bea.com/pub/advisory/3

Scores

EPSS 0.0051

EPSS Percentile 66.7%

Details

Status published

Products (5)

bea/weblogic_integration 7.0 (2 CPE variants)

bea/weblogic_server 6.0 (2 CPE variants)

bea/weblogic_server 6.1 (2 CPE variants)

bea/weblogic_server 7.0 (2 CPE variants)

bea/weblogic_server 7.0.0.1 (2 CPE variants)

Published Dec 31, 2002

Tracked Since Feb 18, 2026