Blazix Server Discloses JSP Source Code to Remote Users
|
|
SecurityTracker Alert ID: 1015837
|
|
SecurityTracker URL: http://securitytracker.com/id?1015837
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Mar 28 2006
|
Impact: Disclosure of system information, Disclosure of user information
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Secunia Research
|
Version(s): 1.2.5
|
Description: A vulnerability was reported in Blazix. A remote user can view JSP source code.
The server does not properly validate filename extensions in URLs. A remote user can supply a specially crafted URL containing dot,
space, and slash characters to view the source code of JSP files on the web server.
The vendor was notified on March 22, 2006.
Tan
Chew Keong of Secunia Research discovered this vulnerability.
The original advisory is available at:
http://secunia.com/secunia_research/2006-22/advisory/
|
Impact: A remote user can view the source code of JSP files on the web server.
|
Solution: The vendor has issued a fixed version (1.2.6), available at:
http://www.blazix.com/download.html
|
Vendor URL: www.blazix.com/ (Links to External Site)
|
Cause: Access control error, Input validation error
|
Underlying OS: Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 28 Mar 2006 08:54:12 -0500
Subject: Blazix Web Server JSP Source Code Disclosure Vulnerability
|
http://secunia.com/secunia_research/2006-22/advisory/
|
|
