Re: Security issue?

On Thu, Nov 18, 2004 at 01:44:15, Max Matslofva said:
> Hi all
> I discovered that a postmaster of any domain can see all accounts and 
> aliases on any domain.
> 
> When a postmaster of his-domain.com has logged in to Jamm, the browser 
> shows the following url
> http://my_jamm_server/jamm/private/index.jsp
> If he click on "Domain Admin" the url change to
> http://my_jamm_server/jamm/private/domain_admin.do?domain=his-domain.com
> If he replace his-domain.com to any domain hosted in the same ldap tree he 
> can see all accounts on that domain.
> 
p> And if he change the url to
> http://my_jamm_server/jamm/private/site_admin.do
> He don't have to guess the domain name, all domains is listed for him.
> 
> But he can't change anything.
> Is this a security issue or just a cosmetic?

What version of Jamm is this?  I thought I had put in a block for
this, but maybe I never completed the work or maybe it doesn't work.
YIKES!

Keith

-- 
 Keith T. Garner                                        [email protected]
                "Make no little plans; they have no magic to
                   stir men's blood." - Daniel H. Burnham


-------------------------------------------------------
This SF.Net email is sponsored by: InterSystems CACHE
FREE OODBMS DOWNLOAD - A multidimensional database that combines
robust object and relational technologies, making it a perfect match
for Java, C++,COM, XML, ODBC and JDBC. www.intersystems.com/match8