Secunia

Information Risk Management Plc. has reported a vulnerability in Portfolio NetPublish, which can be exploited by malicious people to disclose sensitive information.

Input passed to the "template" parameter in "server.np" isn't properly verified, before it is used to view files. This can be exploited to disclose the content of arbitrary files via directory traversal attacks.

Example:
http://[host]/netpub/server.np?base&site=[site]&catalog=catalog&template=[file]

The vulnerability has been reported in version 7. Other versions may also be affected.

Solution
The vendor has provided a workaround for the Microsoft Windows platform:
Further details available in Customer Area

Provided and/or discovered by
Andy Davis and Mazin Faour, Information Risk Management Plc.

Changelog
Further details available in Customer Area

Original Advisory
http://www.irmplc.com/advisory012.htm

Deep Links
Links available in Customer Area