CVE-2002-2177

LowCVSS 2.6/10Last modified Jun 16, 2026

Description

BEA WebLogic Server and Express 6.1 through 7.0.0.1 buffers HTTP requests in a way that can cause BEA to send the same response for two different HTTP requests, which could allow remote attackers to obtain sensitive information that was intended for other users.

Metrics

CVSS 2.0 2.6/10AV:N/AC:H/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://dev2dev.bea.com/pub/advisory/38
http://www.iss.net/security_center/static/10221.phpPatch, Vendor Advisory
http://www.securityfocus.com/bid/5819Patch, Vendor Advisory
http://dev2dev.bea.com/pub/advisory/38
http://www.iss.net/security_center/static/10221.phpPatch, Vendor Advisory
http://www.securityfocus.com/bid/5819Patch, Vendor Advisory

Timeline

Published: Dec 31, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-21784.3Cross-site scripting (XSS) vulnerability in article.php module for phpWebSite 0.8.3 allows remote attackers to execute arbitrary Javascript CVE-2002-21797.8The dynamic initialization feature of the ClearPath MCP environment allows remote attackers to cause a denial of service (crash) via a TCP p CVE-2002-21806.8The setitimer(2) system call in OpenBSD 2.0 through 3.1 does not properly check certain arguments, which allows local users to write to kern CVE-2002-21815.0SonicWall Content Filtering allows local users to access prohibited web sites via requests to the web site's IP address instead of the domai CVE-2002-21826.4Buffer overflow in Seunghyun Seo's MSN666 MSN Sniffer 1.0 and 1.0.1 allows remote attackers to execute arbitrary code via a long MSN packet.CVE-2002-21837.5phpShare.php in phpShare before 0.6 beta 3 allows remote attackers to include and execute arbitrary PHP scripts from remote servers.CVE-2002-21845.0Digi-Net Technologies DigiChat 3.5 allows chat users to obtain the IP addresses of other chat users via a "Showip" parameter in the chat app CVE-2002-21854.9The Internet Group Management Protocol (IGMP) allows local users to cause a denial of service via an IGMP membership report to a target's Et CVE-2002-21865.0Macromedia JRun 3.0, 3.1, and 4.0 allow remote attackers to view the source code of .JSP files via Unicode encoded character values in a URL CVE-2002-21875.0Unknown "file disclosure" vulnerability in Macromedia JRun 3.0, 3.1, and 4.0, related to a log file or jrun.ini, with unknown impact.CVE-2002-21884.9OpenBSD before 3.2 allows local users to cause a denial of service (kernel crash) via a call to getrlimit(2) with invalid arguments, possibl CVE-2002-21895.1Cross-site scripting (XSS) vulnerability in ActiveXperts Software ActiveWebserver allows remote attackers to execute arbitrary web script vi