############################################################### ID: S21SEC-019-en Title: Vignette /vgn/style internal information leak Date: 15/03/2003 Status: Vendor contacted and solution available Scope: Revelation of internal variables Platforms: All Author: rpinuaga Location: http://www.s21sec.com/es/avisos/s21sec-019-en.txt Release: External ############################################################### S 2 1 S E C http://www.s21sec.com Vignette /vgn/style internal information leak About Vignette -------------- Vignette develops Content Management and Application Portal Software. Description of vulnerability ---------------------------- Vignette Software installs by default some help applications under de /vgn web directory. One of this applications return a dump of internal information when the template is accessed directly through a web browser. This information contains variable names, private PATHs, and other information related to the internal state of the Vignette server. The common location for this template is: /vgn/style Affected Versions and platforms ------------------------------- This vulnerability has been tested in Vignette StoryServer and Vignette V/5. But it seems that all currently avaliable versions are vulnerable. Solution -------- Vignette users should procceed to contact vignette throught the standard channels VOLS etc in order to get a solution. Additional information ---------------------- These vulnerabilities have been found and researched by: Ramon Pinuaga Cascales rpinuagaat_private You can find the last version of this warning in: http://www.s21sec.com/es/avisos/s21sec-019-en.txt And other S21SEC warnings in http://www.s21sec.com/es/avisos/
This archive was generated by hypermail 2b30 : Tue May 27 2003 - 12:45:10 PDT