CVE-2001-1544

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Directory traversal vulnerability in Macromedia JRun Web Server (JWS) 2.3.3, 3.0 and 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the HTTP GET request.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.iss.net/security_center/static/7678.php
http://www.macromedia.com/v1/handlers/index.cfm?ID=22290&Method=FullPatch, Vendor Advisory
http://www.securityfocus.com/bid/3666Patch
http://www.iss.net/security_center/static/7678.php
http://www.macromedia.com/v1/handlers/index.cfm?ID=22290&Method=FullPatch, Vendor Advisory
http://www.securityfocus.com/bid/3666Patch

Timeline

Published: Dec 31, 2001
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2001

CVE-2001-15455.0Macromedia JRun 3.0 and 3.1 appends the jsessionid to URL requests (a.k.a. rewriting) when client browsers have cookies enabled, which allow CVE-2001-15467.8Pathways Homecare 6.5 uses weak encryption for user names and passwords, which allows local users to gain privileges by recovering the passw CVE-2001-15477.5Outlook Express 6.0, with "Do not allow attachments to be saved or opened that could potentially be a virus" enabled, does not block email a CVE-2001-15482.1ZoneAlarm 2.1 through 2.6 and ZoneAlarm Pro 2.4 and 2.6 allows local users to bypass filtering via non-standard TCP packets created with non CVE-2001-15492.1Tiny Personal Firewall 1.0 and 2.0 allows local users to bypass filtering via non-standard TCP packets created with non-Windows protocol ada CVE-2001-15502.1CentraOne 5.2 and Centra ASP with basic authentication enabled creates world-writable base64 encoded log files, which allows local users to CVE-2001-15512.1Linux kernel 2.2.19 enables CAP_SYS_RESOURCE for setuid processes, which allows local users to exceed disk quota restrictions during executi CVE-2001-15525.0ssdpsrv.exe in Windows ME allows remote attackers to cause a denial of service by sending multiple newlines in a Simple Service Discovery Pr CVE-2001-15534.6Buffer overflow in setiathome for SETI@home 3.03, if installed setuid, could allow local users to execute arbitrary code via long command li CVE-2001-15545.0IBM AIX 430 does not properly unlock IPPMTU_LOCK, which allows remote attackers to cause a denial of service (hang) via Path Maximum Transmi CVE-2001-15554.6pt_chmod in Solaris 8 does not call fdetach to reset terminal privileges when users log out of terminals, which allows local users to write CVE-2001-15565.0The log files in Apache web server contain information directly supplied by clients and does not filter or quote control characters, which c