PT-2001-2080 · Allaire · Jrun

Publicado 2001-11-28 · Atualizado 2017-12-19 · CVE-2001-0926

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Allaire JRun versions 2.3.3, 3.0, 3.1

Description The issue allows remote attackers to obtain source code for Java server pages (.jsp) and other files in the web root via an HTTP request for a non-existent SSI page. This is achieved by including an #include statement in the request's body.

Recommendations For Allaire JRun versions 2.3.3, 3.0, 3.1, consider restricting access to the SSIFilter to minimize the risk of exploitation. As a temporary workaround, avoid using the #include statement in SSI pages until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2001-0926

Produtos afetados

Jrun

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2001-0926 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7622 · Nota
• http://securityfocus.com/bid/3589 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=100697797325013&w=2 · Nota
• http://macromedia.com/v1/handlers/index.cfm?ID=22261&Method=Full · Aviso do Fabricante