CVE-2000-0499: Bea WebLogic Server

High severity, CVSS 7.5. EPSS: 2.5% chance of exploitation in the next 30 days.

The default configuration of BEA WebLogic 3.1.8 through 4.5.1 allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in upper case.

Affected products

• Bea WebLogic Server: any version; from 3.1.8, up to and including 4.5.1

Published 2000-06-08. Last modified 2026-06-16.