PT-2001-2227 · Allaire · Allaire Jrun

Publicado 2001-07-02 · Atualizado 2017-10-10 · CVE-2001-1084

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Allaire JRun versions 2.3.3 and 3.0

Description A cross-site scripting issue allows a malicious webmaster to embed Javascript in a request for certain file types, including .JSP, .shtml, .jsp10, .jrun, or .thtml, that do not exist. This results in the Javascript being inserted into an error message.

Recommendations For Allaire JRun version 2.3.3, update to a version that fixes this issue. For Allaire JRun version 3.0, update to a version that fixes this issue. As a temporary workaround, consider restricting access to the error messages generated by the server to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2001-1084

Produtos afetados

Allaire Jrun

Referências · 7

• 🔥 http://securityfocus.com/bid/2983 · Exploit
• http://kb.cert.org/vuls/id/654643 · Nota
• http://archive.cert.uni-stuttgart.de/archive/bugtraq/2001/07/msg00021.html · Nota
• http://macromedia.com/v1/handlers/index.cfm?ID=21498&Method=Full · Aviso do Fabricante
• http://osvdb.org/1891 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6793 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2001-1084 · Nota de Segurança