CVE-2000-1247: Low severity Apache jserv vulnerability

Published Oct 5, 2011

Updated

The default configuration of the jserv-status handler in jserv.conf in Apache JServ 1.1.2 includes an "allow from 127.0.0.1" line, which allows local users to discover JDBC passwords or other sensitive information via a direct request to the jserv/ URI.

Affected Software

1 affected component

Apache jserv=1.1.2

Remediation

Patch Available

http://archive.apache.org/dist/java/java.apache.org-www.tar.gz

Event History

Oct 5, 2011

CVE Published

02:56 AM

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2000-1247?

CVE-2000-1247 is classified as a high severity vulnerability due to potential exposure of sensitive information.

How do I fix CVE-2000-1247?

To fix CVE-2000-1247, configure the jserv-status handler to restrict access from sources other than localhost.

What information can be exposed by CVE-2000-1247?

CVE-2000-1247 can expose sensitive information such as JDBC passwords and other confidential data.

Is CVE-2000-1247 still a concern for current software?

While CVE-2000-1247 was identified in Apache JServ 1.1.2, it is important to check if any legacy systems are still in use.

Who is affected by CVE-2000-1247?

Users and administrators of Apache JServ 1.1.2 are affected by CVE-2000-1247 if they have not properly configured their jserv.conf.