Bugtraq mailing list archives

Re: ManageEngine Firewall Analyzer arbitrary file disclosure to authorized user


From: support () fwanalyzer com
Date: 30 Mar 2007 07:06:38 -0000

We thank you for bringing this to our notice & apologize for any inconvenience this has caused.

The reason for this problem is that we were passing the absolute path of the file in the URL. This has now been fixed 
by providing an randomly generated Identifier which is mapped to file. This fix is made available in our upcoming build 
4030. Any users who would like to get an early access to this build can feel free to send us a request mail to <support 
at fwanalyzer dot com>

Thanks & Regards
AJ


Current thread: