Unscored severity · published Dec 31, 2001
CVE-2001-1510
Allaire JRun 2.3.3, 3.0 and 3.1 running on IIS 4.0 and 5.0, iPlanet, Apache, JRun web server (JWS), and possibly other web servers allows remote attackers to read arbitrary files…
–
CVSS
2.5%
EPSS
No
On KEV
Description
Allaire JRun 2.3.3, 3.0 and 3.1 running on IIS 4.0 and 5.0, iPlanet, Apache, JRun web server (JWS), and possibly other web servers allows remote attackers to read arbitrary files and directories by appending (1) "%3f.jsp", (2) "?.jsp" or (3) "?" to the requested URL.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JR
Jrun · Macromedia
2.3.3; 3.0; 3.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2001-1510
CVE.org
https://www.cve.org/CVERecord?id=CVE-2001-1510
online.securityfocus.com
http://online.securityfocus.com/archive/1/242843/2002-07-27/2002-08-02/2
online.securityfocus.com
http://online.securityfocus.com/archive/1/243203
Exploit
http://www.iss.net/security_center/static/7623.php
Exploit
http://www.macromedia.com/v1/handlers/index.cfm?ID=22262&Method=Full
www.securityfocus.com
http://www.securityfocus.com/archive/1/243636
www.securityfocus.com
http://www.securityfocus.com/bid/3592
More from Jrun
–
CVE-2005-4472
Stack-based buffer overflow in the Macromedia JRun 4 web server (JWS) allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long request…
–
CVE-2005-4473
Unspecified vulnerability in Macromedia JRun 4 web server (JWS) allows remote attackers to view web application source code via "a malformed URL."
–
CVE-2005-2306
Race condition in Macromedia JRun 4.0, ColdFusion MX 6.1 and 7.0, when under heavy load, causes JRun to assign a duplicate authentication token to multiple sessions, which could…
–
CVE-2004-2182
Session fixation vulnerability in Macromedia JRun 4.0 allows remote attackers to hijack user sessions by pre-setting the user session ID information used by the session server
–
CVE-2004-1478
JRun 4.0 does not properly generate and handle the JSESSIONID, which allows remote attackers to perform a session fixation attack and hijack a user's HTTP session