Description
RSSFromParent in Plain Black WebGUI before 7.5.13 does not restrict view access to Collaboration System (CS) RSS feeds, which allows remote attackers to obtain sensitive information (CS data).
References
- webgui-collaboration-info-disclosure(43344) vdb-entry
- http://www.webgui.org/bugs/tracker/security-issue---collaboration-rss/
- http://www.webgui.org/getwebgui/advisories/webgui-7_5_13-beta-released
- 29927 vdb-entry
- 30782 third-party-advisory
- ADV-2008-1932 vdb-entry