Adobe JRun 4 (logfile) Directory Traversal Vulnerability (auth)

===============================================================
Adobe JRun 4 (logfile) Directory Traversal Vulnerability (auth)
===============================================================


Directory Traversal vulnerability found in script logviewer.jsp

Using Management Console authenticated attacker can read any file on server.

Also attacker can exploit this issue using XSS (http://www.dsecrg.com/pages/vul/show.php?id=152)


Example:

http://[server]/server/[profile]/logging/logviewer.jsp?logfile=../../../../../../../boot.ini




Fix Information
***************
The issue has been solved 17 august 2009.  http://www.adobe.com/go/apsb09-12



#  0day.today [2018-03-20]  #