John Martinelli has reported a vulnerability in Bradford Campus Manager, which can be exploited by malicious people to gain unprivileged access to restricted data.

The directories runTime/ and remediationReports/ are not password protected, despite containing sensitive information such as backups, log files, and configuration files.

The vulnerability is reported in version 3.1(6). Other versions may also be affected.

Solution
Filter malicious requests in a proxy or firewall with URL filtering capabilities.

Provided and/or discovered by
John Martinelli

Changelog
Further details available in Customer Area

Original Advisory
http://www.john-martinelli.com/work/campusmanager.txt

Deep Links
Links available in Customer Area