CVE-2000-1247: Apache Jserv

Low severity, CVSS 2.1. EPSS: 0.6% chance of exploitation in the next 30 days.

The default configuration of the jserv-status handler in jserv.conf in Apache JServ 1.1.2 includes an "allow from 127.0.0.1" line, which allows local users to discover JDBC passwords or other sensitive information via a direct request to the jserv/ URI.

Affected products

• Apache Jserv: version 1.1.2 only

Published 2011-10-05. Last modified 2026-06-16.