Description
Orion Application Server before 2.0.7, when running on Windows, allows remote attackers to obtain the source code of JSP files via (1) . (dot) and (2) space characters in the extension of a URL.
References
- http://secunia.com/secunia_research/2006-11/advisory/
- 17204 vdb-entry
- 20060323 Secunia Research: Orion Application Server JSP Source DisclosureVulnerability mailing-list
- 1015823 vdb-entry
- ADV-2006-1055 vdb-entry
- 24053 vdb-entry
- 20060323 Secunia Research: Orion Application Server JSP Source Disclosure Vulnerability mailing-list
- orion-jsp-source-disclosure(25405) vdb-entry
- 18950 third-party-advisory