PT-2001-2598 · Macromedia · Macromedia Jrun

Published 2001-12-31 · Updated 2008-09-10 · CVE-2001-1513

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Macromedia JRun versions 3.0 through 3.1

Description The issue allows remote attackers to obtain duplicate active user session IDs and perform actions as other users. This can be achieved by making a URL request for the web application directory without the trailing '/' (slash).

Recommendations For Macromedia JRun versions 3.0 through 3.1, ensure that URL requests for the web application directory include a trailing '/' (slash) to prevent duplicate active user session IDs from being obtained. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2001-1513

Affected Products

Macromedia Jrun

References · 4

• http://macromedia.com/v1/handlers/index.cfm?ID=22260&Method=Full · Vendor Advisory
• http://iss.net/security_center/static/7680.php · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2001-1513 · Security Note
• http://securityfocus.com/bid/3600 · Note