Sign-up

ID

VAR-200006-0147


CVE

CVE-2000-0499


TITLE

BEA WebLogicJSP Source code leak vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-200006-037

DESCRIPTION

The default configuration of BEA WebLogic 3.1.8 through 4.5.1 allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in upper case. Many webservers are case-sensitive, but do not have all possible combinations of cases in mapped extensions mapped properly. In that manner, a user is able to access the source code to those specific files. Microsoft IIS 5.0 has a dedicated scripting engine for advanced file types such as ASP, ASA, HTR, etc. files. The scripting engines handle requests for these file types, processes them accordingly, and then executes them on the server. It is possible to force the server to send back the source of known scriptable files to the client if the HTTP GET request contains a specialized header with 'Translate: f' at the end of it, and if a trailing slash '/' is appended to the end of the URL. The scripting engine will be able to locate the requested file, however, it will not recognize it as a file that needs to be processed and will proceed to send the file source to the client. # Title: Cisco Collaboration Server 5 XSS, Source Code Disclosure # Author: s4squatch # Published: 2010-02-11 Cisco Collaboration Server 5 XSS, Source Code Disclosure Discovered by: s4squatch of SecureState R&D Team (www.securestate.com Discovered: 08/26/2008 Note: End of Engineering --> http://www.cisco.com/en/US/products/sw/custcosw/ps747/prod_eol_notice09186a008032d4d0.html Replaced with: http://www.cisco.com/en/US/products/ps7233/index.html and http://www.cisco.com/en/US/products/ps7236/index.html XSS === http://www.website.com/webline/html/admin/wcs/LoginPage.jhtml?oper=&dest="> Java Servlet Source Code Disclosure =================================== The source code of .jhtml files is revealed to the end user by requesting any of the following: Normal File: file.html Modified 1: file%2Ejhtml Modified 2: file.jhtm%6C Modified 3: file.jhtml%00 Modified 4: file.jhtml%c0%80 Cisco Collaboration Server 5 Paths It Works On (list may not be complete) ========================================================================= http://www.website.com/doc/docindex.jhtml http://www.website.com/browserId/wizardForm.jhtml http://www.website.com/webline/html/forms/callback.jhtml http://www.website.com/webline/html/forms/callbackICM.jhtml http://www.website.com/webline/html/agent/AgentFrame.jhtml http://www.website.com/webline/html/agent/default/badlogin.jhtml http://www.website.com/callme/callForm.jhtml http://www.website.com/webline/html/multichatui/nowDefunctWindow.jhtml http://www.website.com/browserId/wizard.jhtml http://www.website.com/admin/CiscoAdmin.jhtml http://www.website.com/msccallme/mscCallForm.jhtml http://www.website.com/webline/html/admin/wcs/LoginPage.jhtml Related Public Info =================== http://www.securityfocus.com/bid/3592/info http://www.securityfocus.com/bid/1578/info http://www.securityfocus.com/bid/1328/info Scott White<mailto:swhite@securestate.com> | Senior Consultant | SecureState 623.321.2660 - office | 480.440.7595 - mobile | 216.927.2801 - fax [cid:image001.png@01CAAB16.BDE852B0]<https://www.securestate.com/>

Trust: 1.53

sources: NVD: CVE-2000-0499 // BID: 1328 // BID: 1578 // PACKETSTORM: 86199

AFFECTED PRODUCTS

vendor:beamodel:weblogic serverscope:eqversion:*

Trust: 1.0

vendor:beamodel:weblogic serverscope:gteversion:3.1.8

Trust: 1.0

vendor:beamodel:weblogic serverscope:lteversion:4.5.1

Trust: 1.0

vendor:beamodel:weblogic serverscope:eqversion:express

Trust: 0.6

vendor:beamodel:weblogic serverscope:eqversion:4.5.1

Trust: 0.6

vendor:beamodel:weblogic serverscope:eqversion:4.0.4

Trust: 0.6

vendor:beamodel:weblogic serverscope:eqversion:3.1.8

Trust: 0.6

vendor:unifymodel:ewave servletexecscope:eqversion:3.0

Trust: 0.3

vendor:ibmmodel:websphere application serverscope:eqversion:3.0.2.1

Trust: 0.3

vendor:beamodel:systems weblogic serverscope:eqversion:4.5.1

Trust: 0.3

vendor:beamodel:systems weblogicscope:eqversion:4.0.4

Trust: 0.3

vendor:beamodel:systems weblogicscope:eqversion:3.1.8

Trust: 0.3

vendor:unifymodel:ewave servletexec cscope:neversion:3.0

Trust: 0.3

vendor:microsoftmodel:iisscope:eqversion:5.0

Trust: 0.3

vendor:microsoftmodel:iisscope:neversion:4.0

Trust: 0.3

sources: BID: 1328 // BID: 1578 // CNNVD: CNNVD-200006-037 // NVD: CVE-2000-0499

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2000-0499
value: HIGH

Trust: 1.0

CNNVD: CNNVD-200006-037
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2000-0499
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

nvd@nist.gov: CVE-2000-0499
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

sources: CNNVD: CNNVD-200006-037 // NVD: CVE-2000-0499

PROBLEMTYPE DATA

problemtype:CWE-178

Trust: 1.0

sources: NVD: CVE-2000-0499

THREAT TYPE

network

Trust: 0.6

sources: BID: 1328 // BID: 1578

TYPE

unknown

Trust: 0.6

sources: CNNVD: CNNVD-200006-037

EXTERNAL IDS

db:BIDid:1328

Trust: 2.0

db:NVDid:CVE-2000-0499

Trust: 1.6

db:XFid:4694

Trust: 0.6

db:NTBUGTRAQid:20000612 BEA WEBLOGIC JSP SHOWCODE VULNERABILITY

Trust: 0.6

db:CNNVDid:CNNVD-200006-037

Trust: 0.6

db:BIDid:1578

Trust: 0.4

db:BIDid:3592

Trust: 0.1

db:PACKETSTORMid:86199

Trust: 0.1

sources: BID: 1328 // BID: 1578 // PACKETSTORM: 86199 // CNNVD: CNNVD-200006-037 // NVD: CVE-2000-0499

REFERENCES

url:http://www.securityfocus.com/bid/1328

Trust: 1.6

url:http://developer.bea.com/alerts/security_000612.html

Trust: 1.6

url:http://archives.neohapsis.com/archives/ntbugtraq/2000-q2/0262.htm

Trust: 1.6

url:https://exchange.xforce.ibmcloud.com/vulnerabilities/4694

Trust: 1.0

url:http://xforce.iss.net/static/4694.php

Trust: 0.6

url:http://www.servletexec.com/

Trust: 0.3

url:http://www.beasys.com/products/weblogic/index.html

Trust: 0.3

url:http://www-4.ibm.com/software/webservers/appserv/efix.html

Trust: 0.3

url:http://www.microsoft.com/technet/security/bulletin/fq00-058.asp

Trust: 0.3

url:http://www.website.com/doc/docindex.jhtml

Trust: 0.1

url:http://www.website.com/webline/html/admin/wcs/loginpage.jhtml

Trust: 0.1

url:http://www.website.com/callme/callform.jhtml

Trust: 0.1

url:http://www.securityfocus.com/bid/1578/info

Trust: 0.1

url:http://www.cisco.com/en/us/products/ps7233/index.html

Trust: 0.1

url:http://www.website.com/webline/html/forms/callback.jhtml

Trust: 0.1

url:http://www.website.com/browserid/wizard.jhtml

Trust: 0.1

url:http://www.website.com/webline/html/agent/default/badlogin.jhtml

Trust: 0.1

url:http://www.securityfocus.com/bid/1328/info

Trust: 0.1

url:http://www.website.com/webline/html/forms/callbackicm.jhtml

Trust: 0.1

url:http://www.website.com/msccallme/msccallform.jhtml

Trust: 0.1

url:http://www.website.com/browserid/wizardform.jhtml

Trust: 0.1

url:http://www.website.com/webline/html/admin/wcs/loginpage.jhtml?oper=&dest=">

Trust: 0.1

url:http://www.website.com/webline/html/multichatui/nowdefunctwindow.jhtml

Trust: 0.1

url:http://www.cisco.com/en/us/products/ps7236/index.html

Trust: 0.1

url:http://www.securityfocus.com/bid/3592/info

Trust: 0.1

url:https://www.securestate.com/>

Trust: 0.1

url:http://www.website.com/webline/html/agent/agentframe.jhtml

Trust: 0.1

url:http://www.website.com/admin/ciscoadmin.jhtml

Trust: 0.1

url:http://www.cisco.com/en/us/products/sw/custcosw/ps747/prod_eol_notice09186a008032d4d0.html

Trust: 0.1

sources: BID: 1328 // BID: 1578 // PACKETSTORM: 86199 // CNNVD: CNNVD-200006-037 // NVD: CVE-2000-0499

CREDITS

Unify Exploit : Discovered by Niclas Vikstrom and posted to NTbugtraq on June 8, 2000. BEA Systems exploit : Discovered by Shreeraj Shah and published by Foundstone, Inc., June 12, 2000. IBM WebSphere Application Server exploit : Discovered by Shreeraj

Trust: 0.3

sources: BID: 1328

SOURCES

db:BIDid:1328
db:BIDid:1578
db:PACKETSTORMid:86199
db:CNNVDid:CNNVD-200006-037
db:NVDid:CVE-2000-0499

LAST UPDATE DATE

2024-08-14T14:16:23.924000+00:00


SOURCES UPDATE DATE

db:BIDid:1328date:2000-06-08T00:00:00
db:BIDid:1578date:2000-08-14T00:00:00
db:CNNVDid:CNNVD-200006-037date:2005-05-02T00:00:00
db:NVDid:CVE-2000-0499date:2024-01-26T17:43:28.770

SOURCES RELEASE DATE

db:BIDid:1328date:2000-06-08T00:00:00
db:BIDid:1578date:2000-08-14T00:00:00
db:PACKETSTORMid:86199date:2010-02-12T06:51:39
db:CNNVDid:CNNVD-200006-037date:2000-06-08T00:00:00
db:NVDid:CVE-2000-0499date:2000-06-08T04:00:00