CVE-2000-1238
published 2000-12-31CVE-2000-1238: BEA Systems WebLogic Express and WebLogic Server 5.1 SP1-SP6 allows remote attackers to bypass access controls for restricted JSP or servlet pages via a URL…
PriorityP424high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
2.73%
85.9th percentile
BEA Systems WebLogic Express and WebLogic Server 5.1 SP1-SP6 allows remote attackers to bypass access controls for restricted JSP or servlet pages via a URL with multiple / (forward slash) characters before the restricted pages.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| bea | weblogic_server | — | — |
| bea | weblogic_server | — | — |
| bea | weblogic_server | — | — |
| bea | weblogic_server | — | — |
| bea | weblogic_server | — | — |
| bea | weblogic_server | — | — |
| bea | weblogic_server | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
BEA WebLogic Server 5.1 Restrictions privileges management (SP7 / ID 86365)
vuldb·2026-09-24·CVSS 7.5
CVE-2000-1238 [HIGH] BEA WebLogic Server 5.1 Restrictions privileges management (SP7 / ID 86365)
A vulnerability labeled as critical has been found in BEA WebLogic Server 5.1. This affects an unknown function of the component Restrictions Handler. Executing a manipulation can lead to improper privilege management.
This vulnerability is tracked as CVE-2000-1238. The attack can be launched remotely. No exploit exists.
It is best practice to apply a patch to resolve this issue.
GHSA
GHSA-p2gc-6r4p-xp97: BEA Systems WebLogic Express and WebLogic Server 5
ghsa_unreviewed·2022-05-03
CVE-2000-1238 [HIGH] GHSA-p2gc-6r4p-xp97: BEA Systems WebLogic Express and WebLogic Server 5
BEA Systems WebLogic Express and WebLogic Server 5.1 SP1-SP6 allows remote attackers to bypass access controls for restricted JSP or servlet pages via a URL with multiple / (forward slash) characters before the restricted pages.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
ftp://ftpna.bea.com/pub/releases/patches/SecurityBEA00-0600.ziphttp://www.securityfocus.com/bid/5089https://exchange.xforce.ibmcloud.com/vulnerabilities/5588ftp://ftpna.bea.com/pub/releases/patches/SecurityBEA00-0600.ziphttp://www.securityfocus.com/bid/5089https://exchange.xforce.ibmcloud.com/vulnerabilities/5588
2000-12-31
Published