VulnerabilityModified
CVE-2001-1511
JRun 3.0 and 3.1 running on JRun Web Server (JWS) and IIS allows remote attackers to read arbitrary JavaServer Pages (JSP) source code via a request URL containing the source filename ending in (1) "jsp%00" or (2) "js%2570".
MEDIUM 5.0EPSS 1.32%
Does this matter?
Lower severity and a low EPSS score (1.32%). Track it; it rarely justifies an emergency change on its own.
Description
JRun 3.0 and 3.1 running on JRun Web Server (JWS) and IIS allows remote attackers to read arbitrary JavaServer Pages (JSP) source code via a request URL containing the source filename ending in (1) "jsp%00" or (2) "js%2570".
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 1.32% probability · 69th percentile
- CISA KEV
- Not listed
- Affected
- macromedia/jrun
- Source
- cve@mitre.org
References
- http://www.iss.net/security_center/static/7676.phpExploit, Patch
- http://www.macromedia.com/v1/handlers/index.cfm?ID=22288&Method=FullExploit, Patch, Vendor Advisory
- http://www.iss.net/security_center/static/7676.phpExploit, Patch
- http://www.macromedia.com/v1/handlers/index.cfm?ID=22288&Method=FullExploit, Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.