CVE-2001-1513 Macromedia JRun 3.0 and 3.1 allows remote attackers to obtain duplicate active user session IDs and perform actions as other users via a URL request for the web application directory without the trail...
HighCVSS 7.5
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Macromedia JRun 3.0 and 3.1 allows remote attackers to obtain duplicate active user session IDs and perform actions as other users via a URL request for the web application directory without the trailing '/' (slash), as demonstrated using ctx.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| macromedia jrun | = 3.0 | No fix listed |
| macromedia jrun | = 3.1 | No fix listed |
References
- allaire-jrun-sessionid-duplicated(7680) patch vdb-entry
- www.macromedia.com patch vendor-advisory
- 3600 vdb-entry