| Package | Affected versions | Patched versions |
|---|---|---|
| jserv | = 1.1.2 |
The default configuration of the jserv-status handler in jserv.conf in Apache JServ 1.1.2 includes an "allow from 127.0.0.1" line, which allows local users to discover JDBC passwords or other sensitive information via a direct request to the jserv/ URI.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free