PT-2002-2031 · Adobe · Jrun

Published 2002-10-04 · Updated 2008-09-05 · CVE-2002-1025

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: JRun versions 3.0 through 4.0

Description: The issue allows remote attackers to read JSP source code by sending an HTTP GET request with an encoded null byte, causing the server to send the .JSP file unparsed.

Recommendations: For JRun versions 3.0 through 4.0, consider restricting access to JSP files until a patch is available. As a temporary workaround, avoid using encoded null bytes in HTTP GET requests to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2002-1025

Affected Products

Jrun

References · 7

• 🔥 http://securityfocus.com/bid/5134 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-1025 · Security Note
• http://iss.net/security_center/static/9459.php · Vendor Advisory
• http://online.securityfocus.com/archive/1/280062 · Note
• http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0138.html · Note
• http://osvdb.org/5028 · Note
• http://macromedia.com/v1/handlers/index.cfm?ID=23164 · Note