VulnerabilityModified
CVE-2006-0816
Orion Application Server before 2.0.7, when running on Windows, allows remote attackers to obtain the source code of JSP files via (1) .
MEDIUM 5.0EPSS 2.57%
Does this matter?
Lower severity and a low EPSS score (2.57%). Track it; it rarely justifies an emergency change on its own.
Description
Orion Application Server before 2.0.7, when running on Windows, allows remote attackers to obtain the source code of JSP files via (1) . (dot) and (2) space characters in the extension of a URL.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 2.57% probability · 84th percentile
- CISA KEV
- Not listed
- Affected
- orionserver/orion application server
- Source
- cve@mitre.org
References
- http://archives.neohapsis.com/archives/fulldisclosure/2006-03/1455.htmlBroken Link, Third Party Advisory
- http://secunia.com/advisories/18950Third Party Advisory
- http://secunia.com/secunia_research/2006-11/advisory/Third Party Advisory
- http://securitytracker.com/id?1015823Third Party Advisory, VDB Entry
- http://www.osvdb.org/24053Broken Link
- http://www.securityfocus.com/archive/1/428601/100/0/threaded
- http://www.securityfocus.com/bid/17204Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2006/1055Broken Link, Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25405Third Party Advisory, VDB Entry
- http://archives.neohapsis.com/archives/fulldisclosure/2006-03/1455.htmlBroken Link, Third Party Advisory
- http://secunia.com/advisories/18950Third Party Advisory
- http://secunia.com/secunia_research/2006-11/advisory/Third Party Advisory
- http://securitytracker.com/id?1015823Third Party Advisory, VDB Entry
- http://www.osvdb.org/24053Broken Link
- http://www.securityfocus.com/archive/1/428601/100/0/threaded
- http://www.securityfocus.com/bid/17204Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2006/1055Broken Link, Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25405Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.