CVE-2001-1545

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Macromedia JRun 3.0 and 3.1 appends the jsessionid to URL requests (a.k.a. rewriting) when client browsers have cookies enabled, which allows remote attackers to obtain session IDs and hijack sessions via HTTP referrer fields or sniffing.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.iss.net/security_center/static/7679.php
http://www.macromedia.com/v1/handlers/index.cfm?ID=22291&Method=FullPatch, Vendor Advisory
http://www.securityfocus.com/bid/3665Patch
http://www.iss.net/security_center/static/7679.php
http://www.macromedia.com/v1/handlers/index.cfm?ID=22291&Method=FullPatch, Vendor Advisory
http://www.securityfocus.com/bid/3665Patch

Timeline

Published: Dec 31, 2001
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2001

CVE-2001-15467.8Pathways Homecare 6.5 uses weak encryption for user names and passwords, which allows local users to gain privileges by recovering the passw CVE-2001-15477.5Outlook Express 6.0, with "Do not allow attachments to be saved or opened that could potentially be a virus" enabled, does not block email a CVE-2001-15482.1ZoneAlarm 2.1 through 2.6 and ZoneAlarm Pro 2.4 and 2.6 allows local users to bypass filtering via non-standard TCP packets created with non CVE-2001-15492.1Tiny Personal Firewall 1.0 and 2.0 allows local users to bypass filtering via non-standard TCP packets created with non-Windows protocol ada CVE-2001-15502.1CentraOne 5.2 and Centra ASP with basic authentication enabled creates world-writable base64 encoded log files, which allows local users to CVE-2001-15512.1Linux kernel 2.2.19 enables CAP_SYS_RESOURCE for setuid processes, which allows local users to exceed disk quota restrictions during executi CVE-2001-15525.0ssdpsrv.exe in Windows ME allows remote attackers to cause a denial of service by sending multiple newlines in a Simple Service Discovery Pr CVE-2001-15534.6Buffer overflow in setiathome for SETI@home 3.03, if installed setuid, could allow local users to execute arbitrary code via long command li CVE-2001-15545.0IBM AIX 430 does not properly unlock IPPMTU_LOCK, which allows remote attackers to cause a denial of service (hang) via Path Maximum Transmi CVE-2001-15554.6pt_chmod in Solaris 8 does not call fdetach to reset terminal privileges when users log out of terminals, which allows local users to write CVE-2001-15565.0The log files in Apache web server contain information directly supplied by clients and does not filter or quote control characters, which c CVE-2001-15577.5Buffer overflow in ftpd in IBM AIX 4.3 and 5.1 allows attackers to gain privileges.