CVE-2007-6198

EPSS 7.0%

portal/server.pt in the Plumtree portal in BEA AquaLogic Interaction 5.0.2 through 5.0.4 and 6.0.1.218452 allows wildcards in advanced searches for usernames, which allows remote attackers to enumerate valid usernames via the in_tx_fulltext parameter.

Affected products

n/a · n/a

public PoCs found — 1

exploitdbwww.exploit-db.com/exploits/30822unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://procheckup.com/Vulnerability_PR06-11.php http://secunia.com/advisories/27840 http://www.securityfocus.com/archive/1/484469/100/0/threaded http://www.securityfocus.com/bid/26620 http://www.securitytracker.com/id?1019004 http://www.vupen.com/english/advisories/2007/4040