PT-2001-2080 · Allaire · Jrun

Published 2001-11-28 · Updated 2017-12-19 · CVE-2001-0926

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Allaire JRun versions 2.3.3, 3.0, 3.1

Description The issue allows remote attackers to obtain source code for Java server pages (.jsp) and other files in the web root via an HTTP request for a non-existent SSI page. This is achieved by including an #include statement in the request's body.

Recommendations For Allaire JRun versions 2.3.3, 3.0, 3.1, consider restricting access to the SSIFilter to minimize the risk of exploitation. As a temporary workaround, avoid using the #include statement in SSI pages until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2001-0926

Affected Products

Jrun

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2001-0926 · Security Note
• http://securityfocus.com/bid/3589 · Vendor Advisory
• http://macromedia.com/v1/handlers/index.cfm?ID=22261&Method=Full · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7622 · Note
• http://marc.info/?l=bugtraq&m=100697797325013&w=2 · Note