CVE-2000-1050
MediumExploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
Allaire JRun 3.0 http servlet server allows remote attackers to directly access the WEB-INF directory via a URL request that contains an extra "/" in the beginning of the request (aka the "extra leading slash").
Risk Assessment
An attacker can access sensitive configuration files and application code, potentially leading to data disclosure or further attacks.
Recommendation
Update JRun to a newer version or apply appropriate filtering rules on the server to block such requests.
Other vulnerabilities in Allaire JRun
See all- CVE-2000-1051Medium
Directory traversal vulnerability in Allaire JRun 2.3 server allows remote attackers to read arbitrary files via the SSIFilter servlet. The attack does not require authentication.
- CVE-2000-1052Medium
Allaire JRun 2.3 server allows remote attackers to obtain source code for executable content by directly calling the SSIFilter servlet. This can lead to disclosure of sensitive information.
Original NVD description (English source)
Allaire JRun 3.0 http servlet server allows remote attackers to directly access the WEB-INF directory via a URL request that contains an extra "/" in the beginning of the request (aka the "extra leading slash").