Security issue?

Hi all
I discovered that a postmaster of any domain can see all accounts and aliases on any domain.

When a postmaster of his-domain.com has logged in to Jamm, the browser shows the following url
http://my_jamm_server/jamm/private/index.jsp
If he click on "Domain Admin" the url change to
http://my_jamm_server/jamm/private/domain_admin.do?domain=his-domain.com
If he replace his-domain.com to any domain hosted in the same ldap tree he can see all accounts on that domain.

And if he change the url to
http://my_jamm_server/jamm/private/site_admin.do
He don't have to guess the domain name, all domains is listed for him.

But he can't change anything.
Is this a security issue or just a cosmetic?


Max




-------------------------------------------------------
This SF.Net email is sponsored by: InterSystems CACHE
FREE OODBMS DOWNLOAD - A multidimensional database that combines
robust object and relational technologies, making it a perfect match
for Java, C++,COM, XML, ODBC and JDBC. www.intersystems.com/match8