CVE-2002-1025 JRun 3.0 through 4.0 allows remote attackers to read JSP source code via an encoded null byte in an HTTP GET request, which causes the server to send the .JSP file unparsed.
MediumCVSS 5.0
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
JRun 3.0 through 4.0 allows remote attackers to read JSP source code via an encoded null byte in an HTTP GET request, which causes the server to send the .JSP file unparsed.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| macromedia jrun | = 3.0 | No fix listed |
| macromedia jrun | = 3.1 | No fix listed |
| macromedia jrun | = 4.0 | No fix listed |
References
- 20020701 [VulnWatch] KPMG-2002026: Jrun sourcecode Disclosure mailing-list
- 20020701 KPMG-2002026: Jrun sourcecode Disclosure mailing-list
- jrun-null-view-source(9459) patch vdb-entry vendor-advisory
- www.macromedia.com
- 5028 vdb-entry
- 5134 exploit patch vdb-entry vendor-advisory