CVE-2004-0711

BEA WebLogic Server - URL Pattern Bypass via Illegal Wildcard Handling

Title source: llm

Description

The URL pattern matching feature in BEA WebLogic Server 6.x matches illegal patterns ending in "*" as wildcards as if they were the legal "/*" pattern, which could cause WebLogic 7.x to allow remote attackers to bypass intended access restrictions because the illegal patterns are properly rejected.

References (4)

Core 4

Core References

Patch, Vendor Advisory vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/10184

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/15927

Various Sources x_refsource_confirm

http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_56.00.jsp

Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert-vn

http://www.kb.cert.org/vuls/id/184558

Scores

EPSS 0.0073

EPSS Percentile 72.9%

Details

Status published

Products (2)

bea/weblogic_server 7.0 (15 CPE variants)

bea/weblogic_server 8.1 (6 CPE variants)

Published Jul 27, 2004

Tracked Since Feb 18, 2026