Login Request a demo
Unscored severity · published Nov 28, 2001
CVE-2001-0926
SSIFilter in Allaire JRun 3.1, 3.0 and 2.3.3 allows remote attackers to obtain source code for Java server pages (.jsp) and other files in the web root via an HTTP request for a…
–
CVSS
2.5%
EPSS
No
On KEV
Description
SSIFilter in Allaire JRun 3.1, 3.0 and 2.3.3 allows remote attackers to obtain source code for Java server pages (.jsp) and other files in the web root via an HTTP request for a non-existent SSI page, in which the request's body has an #include statement.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JR
Jrun · Macromedia
2.3.3; 3.0; 3.1 · source: NVD
Affected product
JR
Jrun
Macromedia
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2001-0926
CVE.org
https://www.cve.org/CVERecord?id=CVE-2001-0926
marc.info
http://marc.info/?l=bugtraq&m=100697797325013&w=2
Patch
http://www.macromedia.com/v1/handlers/index.cfm?ID=22261&Method=Full
Patch
http://www.securityfocus.com/bid/3589
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/7622
More from Jrun
–
CVE-2005-4472
Stack-based buffer overflow in the Macromedia JRun 4 web server (JWS) allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long request…
–
CVE-2005-4473
Unspecified vulnerability in Macromedia JRun 4 web server (JWS) allows remote attackers to view web application source code via "a malformed URL."
–
CVE-2005-2306
Race condition in Macromedia JRun 4.0, ColdFusion MX 6.1 and 7.0, when under heavy load, causes JRun to assign a duplicate authentication token to multiple sessions, which could…
–
CVE-2004-2182
Session fixation vulnerability in Macromedia JRun 4.0 allows remote attackers to hijack user sessions by pre-setting the user session ID information used by the session server
–
CVE-2004-1478
JRun 4.0 does not properly generate and handle the JSESSIONID, which allows remote attackers to perform a session fixation attack and hijack a user's HTTP session