CVE-2009-0700: Undefined Security Weakness

Plunet BusinessManager 4.1 and earlier allows remote authenticated users to bypass access restrictions and 1 read sensitive Customer or Order data via a modified Pfad parameter to pagesUTF8/SysDirAnzeige.jsp, or 2 list sensitive Jobs via a direct request to pagesUTF8/auftragjob.jsp...