vulnerability of BEA WebLogic Hex Encoded Request JSP Source Disclosure (10715)

• 

  globalrelayoperations · Member · Aug 23, 2022 at 6:40 pm

  • Copy link
  • Add topic to favorites

  Synopsis
  The remote web server is affected by an information disclosure vulnerability.
  Description
  The version of BEA WebLogic installed on the remote host may be tricked into revealing the source code of JSP scripts by using simple URL encoding of characters in the filename extension.
  Solution
  Use the official patch available at http://www.bea.com/ to upgrade to WebLogic version 5.1.0 SP 8 or later.

  Thank you for your help.

  WP.com: Yes
  Correct account: Yes

  The blog I need help with is: (visible only to logged in users)

• 

  supernovia · Staff · Aug 25, 2022 at 11:54 pm

  • Copy link

  @globalrelayoperations, could you clarify what site you need help with? Also, where are you getting this error?

• 

  globalrelayoperations · Member · Sep 2, 2022 at 3:59 pm

  • Copy link

  websites are: globalrelayggp.org and grbridgethegap.com
  This vulnerability was found by using a nessus scanner

• 

  supernovia · Staff · Sep 2, 2022 at 11:48 pm

  • Copy link

  Thanks. Both of these sites get direct support from the team that manages sites with outside plugins and what not. Can you log in as the site owner and open a chat here?
  https://wordpress.com/help/contact

  We’ll also share this with our security folks.

• 

  supernovia · Staff · Sep 5, 2022 at 6:29 pm

  • Copy link

  Just to follow up on this, our security team let us know the server doesn’t use BEA WebLogic, so it would seem this is a false positive.

  Cheers!