Hitachi Groupmax Scheduler Server Unauthorized Access Vulnerability

Bugtraq ID:	36184
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 21 2009 12:00AM
Updated:	Aug 31 2009 04:22PM
Credit:	Hitachi
Vulnerable:	Hitachi Scheduler Server Set 0 Hitachi Groupware Server Set 0 Hitachi Groupmax Server Set 0 Hitachi Groupmax Groupware Server 0
Not Vulnerable:

Hitachi Groupmax Scheduler Server Unauthorized Access Vulnerability

Hitachi Groupmax Scheduler Server is prone to a vulnerability that can result in unauthorized access.

A remote attacker can exploit this issue to bypass security restrictions and gain unauthorized access to privileged data.

The following are vulnerable:

Groupmax Groupware Server
Groupmax Server Set
Groupware Server Set
Scheduler Server Set

Hitachi Groupmax Scheduler Server Unauthorized Access Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Hitachi Groupmax Scheduler Server Unauthorized Access Vulnerability

Solution:
The vendor has released an advisory and patches. Please see the references for details.

Hitachi Groupmax Scheduler Server Unauthorized Access Vulnerability

References:

• JVNDB-2009-001930 Issue of Access Control Failure in Groupmax Scheduler Server (JVN)
  
• HS09-012 Groupmax Scheduler Server (Hitachi)