PT-2002-2031 · Adobe · Jrun

Publicado 2002-10-04 · Atualizado 2008-09-05 · CVE-2002-1025

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: JRun versions 3.0 through 4.0

Description: The issue allows remote attackers to read JSP source code by sending an HTTP GET request with an encoded null byte, causing the server to send the .JSP file unparsed.

Recommendations: For JRun versions 3.0 through 4.0, consider restricting access to JSP files until a patch is available. As a temporary workaround, avoid using encoded null bytes in HTTP GET requests to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2002-1025

Produtos afetados

Jrun

Referências · 7

• 🔥 http://securityfocus.com/bid/5134 · Exploit
• http://online.securityfocus.com/archive/1/280062 · Nota
• http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0138.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-1025 · Nota de Segurança
• http://osvdb.org/5028 · Nota
• http://macromedia.com/v1/handlers/index.cfm?ID=23164 · Nota
• http://iss.net/security_center/static/9459.php · Aviso do Fabricante