CVE-ID

CVE-2000-0812
Learn more at National Vulnerability Database (NVD)
• CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The administration module in Sun Java web server allows remote attackers to execute arbitrary commands by uploading Java code to the module and invoke the com.sun.server.http.pagecompile.jsp92.JspServlet by requesting a URL that begins with a /servlet/ tag.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
Assigning CNA
MITRE Corporation
Date Record Created
20000926 Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Interim (20010117)
Votes (Legacy)
ACCEPT(2) Baker, Dik
MODIFY(2) Frech, Levy
NOOP(3) Armstrong, Cole, Wall
REVIEWING(1) Christey
Comments (Legacy) 
 Frech> XF:sunjava-webadmin-bbs(5135)
 Levy> BID 1600
 Frech> We also show this associated with CVE-2000-0629: The default
   configuration of the Sun Java web server 2.0 and earlier allows remote
   attackers to execute arbitrary commands by uploading Java code to the
   server via board.html, then directly calling the JSP compiler
   servlet. CVE web site concurs.
 Christey> I think that Casper Dik confirmed that CVE-2000-0629 is a
   configuration problem, and this one is a bug, so they are
   different problems.  I need to dig up that email, though...
 Dik> CVE-2000-0629 indeed is about sample code which shouldn't
   be run on prodution servers
   This one is an actual bug and patches have been produced
   for JWS 2.0 and 1.1.3
Proposed (Legacy)
20001018
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
  
You can also search by reference using the CVE Reference Maps.
For More Information:  CVE Request Web Form (select "Other" from dropdown)
Back to top