CVE-2004-0711: Bea WebLogic Server

High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days.

The URL pattern matching feature in BEA WebLogic Server 6.x matches illegal patterns ending in "*" as wildcards as if they were the legal "/*" pattern, which could cause WebLogic 7.x to allow remote attackers to bypass intended access restrictions because the illegal patterns are properly rejected.

Affected products

• Bea WebLogic Server: version 7.0 only; version 8.1 only

Published 2004-07-27. Last modified 2026-06-16.