[cobalt-users] RaQ550 information leak

["Rusty Waybrant" <rwaybrant@xxxxxxxxxxxxx>]

Got an interesting call today...

Basically site-adm from siteA logs in and gets a URL similar to this:
http://host.example.net:444/nav/cList.php?root=sitemanageRoot&group=site
1&hostname=host.example.net&goto=base_userList

This site-adm changes the 'siteA' in the URL to say 'siteB', and is then
given the information from siteB without having to auth. as a site-adm
from siteB... 

I tested and can reproduce with any site-adm going to any other vsite.
It appears to be only information leak (User list, web setup, usage
info, etc.), as siteA's admin cannot make changes in siteB. If you do
try to make a change in another vsite, you get Red-! with "Permission
for X is denied." 

Is there a way to stop a site-adm from seeing any vsite other than their
own?

Rusty Waybrant
rwaybrant@xxxxxxxxxxxxx