BEA AquaLogic Interaction 6.0/6.1 Plumtree Portal Multiple Information Disclosure Vulnerabilities

ID SSV:84186
Type seebug
Reporter Root
Modified 2014-07-01T00:00:00


No description provided by source.


BEA AquaLogic Interaction is prone to multiple information-disclosure vulnerabilities.

Attackers can exploit these issues to access valid usernames in the Plumtree portal as well as the server hostname, build date, and server version. Information harvested can aid in further attacks.

The following versions are vulnerable:

BEA Plumtree Foundation in the 5.0 series, version 6.0 through service pack 1 on all platforms
BEA AquaLogic Interaction 6.1 through service pack 1 on all platforms*&in_hi_req_ apps=1&control=advancedstart&in_hi_req_page=100&parentname=AdvancedSearch&in_ra_ topoperator=and*admin*&in_hi_ req_apps=1&control=advancedstart&in_hi_req_page=100&parentname=AdvancedSearch&in_ra_ topoperator=and*test*&in_hi_req_apps= 1&control=advancedstart&in_ hi_req_page=100&parentname=AdvancedSearch&in_ra_topoperator=and