CVE Daily

CVE-2000-1247

The default configuration of the jserv-status handler in jserv.conf in Apache JS...

Low CVSS 2.1

Overview

The default configuration of the jserv-status handler in jserv.conf in Apache JServ 1.1.2 includes an "allow from 127.0.0.1" line, which allows local users to discover JDBC passwords or other sensitive information via a direct request to the jserv/ URI.

CWE: CWE-16 Published: 2011-10-05T02:56:24.427
Risk analysis

This vulnerability is rated 🟢 LOW.

  • CVSS: 2.1 (LOW)
  • Detected tags: none (tag impact: LOW)

Recommended actions:

  • Prioritize remediation based on business criticality and exposure.
  • Limit exposure and increase monitoring until fixed.

Recommended tools

Tags