CVE-2002-1025: JRun 3.0 through 4.0 allows remote attackers to read JSP source code via an encoded null byte in an HTTP GE...

Security readout for executives and security teams

CVE-2002-1025 is a source-code disclosure flaw in JRun 3.0 through 4.0. A remote attacker could cause JSP files to be returned as source instead of executed. Business impact depends on whether old JRun systems are still exposed and whether JSP source contains credentials, internal logic, or sensitive integration details. Exposure is most likely in legacy internet-facing JRun 3.0 through 4.0 deployments, archived applications, or forgotten internal systems reachable through reverse proxies. Modern environments are unlikely to be affected unless they still run old JRun components. Prioritize if any JRun 3.0 through 4.0 system is internet-facing or handles sensitive application logic. The main business risk is disclosure of source code and secrets from legacy infrastructure, not confirmed ransomware-style exploitation in the provided evidence. Mitigation focus: Inventory systems for JRun 3.0 through 4.0 exposure.; Check original vendor guidance before choosing a patch or configuration change.; Remove, isolate, or replace unsupported legacy JRun services..

Prepared

Jun 30, 2026, 11:55 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.