Secunia

@stake has reported a security issue in Vignette Application Portal, which can be exploited by malicious people to gain knowledge of various system information.

The problem is that the included diagnostic utility by default is accessible to anyone. This discloses information like application server and OS versions, database connection parameters, and bean IDs used for accessing portal resources.

Example:
http://[host]/portal/diag/

Solution
The vendor has published KB article 6947, which describes workarounds.
Further details available in Customer Area

Provided and/or discovered by
Cory Scott, @stake.

Original Advisory
http://www.atstake.com/research/advisories/2004/a092804-1.txt

Deep Links
Links available in Customer Area