PT-2001-2630 · Macromedia · Macromedia Jrun

Published 2001-12-31 · Updated 2008-09-05 · CVE-2001-1545

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Macromedia JRun versions 3.0 and 3.1

Description The issue allows remote attackers to obtain session IDs and hijack sessions. This can occur via HTTP referrer fields or sniffing when client browsers have cookies enabled and the session ID is appended to URL requests.

Recommendations For Macromedia JRun versions 3.0 and 3.1, consider disabling the session ID rewriting feature to prevent session hijacking until a patch is available. Restrict access to sensitive areas of the application to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2001-1545

Affected Products

Macromedia Jrun

References · 4

• http://macromedia.com/v1/handlers/index.cfm?ID=22291&Method=Full · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-1545 · Security Note
• http://securityfocus.com/bid/3665 · Patch
• http://iss.net/security_center/static/7679.php · Note