CVE:CVE-2008-0904
CNNVD:CNNVD-200802-421
BEA Plumtree Collaboration和AquaLogic Interaction的download servlet存在未明漏洞。远程攻击者可以通过一个精心设计的URL来读取任意文件。
solution:Upgrade bea_systems aqualogic_interaction to a higher version than 4.2,4.2_mp1,and avoid the version 4.2,4.2_mp1; Upgrade bea_systems plumtree_collaboration to a higher version than 4.1,4.1_sp1,4.1_sp2,and avoid the version 4.1,4.1_sp1,4.1_sp2