Unscored severity · published Jun 22, 2000
CVE-2000-0539
Servlet examples in Allaire JRun 2.3.x allow remote attackers to obtain sensitive information, e.g
–
CVSS
1.6%
EPSS
No
On KEV
Description
Servlet examples in Allaire JRun 2.3.x allow remote attackers to obtain sensitive information, e.g. listing HttpSession ID's via the SessionServlet servlet.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JR
Jrun · Macromedia
2.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2000-0539
CVE.org
https://www.cve.org/CVERecord?id=CVE-2000-0539
Patch
http://www.allaire.com/handlers/index.cfm?ID=16290&Method=Full
www.osvdb.org
http://www.osvdb.org/818
Patch
http://www.securityfocus.com/bid/1386
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/4774
More from Jrun
–
CVE-2005-4472
Stack-based buffer overflow in the Macromedia JRun 4 web server (JWS) allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long request…
–
CVE-2005-4473
Unspecified vulnerability in Macromedia JRun 4 web server (JWS) allows remote attackers to view web application source code via "a malformed URL."
–
CVE-2005-2306
Race condition in Macromedia JRun 4.0, ColdFusion MX 6.1 and 7.0, when under heavy load, causes JRun to assign a duplicate authentication token to multiple sessions, which could…
–
CVE-2004-2182
Session fixation vulnerability in Macromedia JRun 4.0 allows remote attackers to hijack user sessions by pre-setting the user session ID information used by the session server
–
CVE-2004-1478
JRun 4.0 does not properly generate and handle the JSESSIONID, which allows remote attackers to perform a session fixation attack and hijack a user's HTTP session