Vignette 4.x/5.0 - Memory Disclosure

source: https://www.securityfocus.com/bid/7684/info

Vignette is prone to an issue which may expose the contents of memory to remote attackers. This condition is due to a flaw in how StoryServer calculates the size of certain characters in URI variables, which may cause data from adjacent memory to be returned to the remote attacker in the response.

This issue was reported for Vignette on IBM AIX. Other platforms may also be affected, though this has not been confirmed. The issue affects some of the default templates provided with Vignette.

http://www.example.com/vgn/login/1,501,,00.html?cookieName=x--\>