Allaire JRun 3.0 http servlet server allows remote attackers to directly access the WEB-INF directory via a URL request that contains an extra / in the beginning of the request (aka the extra leading slash).
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Jrun | Macromedia | 3.0 (including) | 3.0 (including) |
| Jrun | Macromedia | 3.0-sp1 (including) | 3.0-sp1 (including) |