The default configuration of BEA WebLogic 3.1.8 through 4.5.1 allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in upper case.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Weblogic_server | Bea | * | * |
| Weblogic_server | Bea | 3.1.8 | 3.1.8 |
| Weblogic_server | Bea | 4.0.4 | 4.0.4 |
| Weblogic_server | Bea | 4.5.1 | 4.5.1 |