CVE-2005-4757
BEA WebLogic Server & WebLogic Express <8.1 SP3 & <7.0 SP5 - Path T...
Title source: llmDescription
BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, do not properly "constrain" a "/" (slash) servlet root URL pattern, which might allow remote attackers to bypass intended servlet protections.
References (3)
Core 3
Core References
Patch, Vendor Advisory vendor-advisory
x_refsource_bea
http://dev2dev.bea.com/pub/advisory/147
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/15052
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/17138
Scores
EPSS
0.0023
EPSS Percentile
45.2%
Details
Status
published
Products (2)
bea/weblogic_server
7.0 (12 CPE variants)
bea/weblogic_server
8.1 (8 CPE variants)
Published
Dec 31, 2005
Tracked Since
Feb 18, 2026