Description
Blazix Web Server before 1.2.6, when running on Windows, allows remote attackers to obtain the source code of JSP files via (1) . (dot), (2) space, and (3) slash characters in the extension of a URL.
References
- 19341 third-party-advisory
- 24178 vdb-entry
- 1015837 vdb-entry
- ADV-2006-1133 vdb-entry
- blazix-jsp-source-disclosure(25485) vdb-entry
- 17270 vdb-entry
- 20060328 Secunia Research: Blazix Web Server JSP Source Code DisclosureVulnerability mailing-list
- 643 third-party-advisory
- http://secunia.com/secunia_research/2006-22/advisory/