CVE-2000-1053: Allaire JRun 2.3.3 server allows remote attackers to compile and execute JSP code by inserting it via a cro...

Security readout for executives and security teams

An old Allaire JRun 2.3.3 web server has a flaw that lets an outside attacker trick the server into running attacker-supplied Java code. The problem stems from combining a cross-site scripting weakness with a directly reachable internal JSP compiler component. Any organization still running this legacy product would face serious risk, though the software is long out of support. Exposure is limited to legacy environments still running Allaire JRun 2.3.x, a product line discontinued after Macromedia and later Adobe ended support. Any internet-reachable instance should be considered high risk; internal-only instances remain a lateral-movement concern. Medium-to-high priority only if the business still operates any JRun 2.3.x system; otherwise informational. Because the product has been unsupported for many years, discovery of a running instance should trigger an urgent decommissioning or replacement project rather than an attempt to patch in place. Mitigation focus: Retire or replace any remaining Allaire/Macromedia JRun 2.3.x deployments; the product is end-of-life.; If retirement is not immediate, isolate JRun hosts behind a WAF and block internet access.; Restrict access to the com.livesoftware.jrun.plugins.JSP servlet path via web server ACLs..

Prepared

Jul 12, 2026, 00:17 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.