security hole in LBI - LawsonGuru.com - LawsonGuru.com Forums -

Name	Points
Greg Moeller	4184
David Williams	3349
JonA	3291
Kat V	2984
Woozy	1973
Jimmy Chiu	1883
Kwane McNeal	1437
Ragu Raghavan	1375
Roger French	1315
mark.cook	1244

Jimmy Chiu

Veteran Member Send Private Message

Posts: 641

9/29/2010 5:49 PM

I just logged this hole with Lawson. Hopefully they will fix it soon. Anyway, here is the security hole. Ie: http://server:port/efs/ConfigurationAssistant No login check, nothing, and you can make changes.

Matthew Nye

Veteran Member Send Private Message

Posts: 514

9/29/2010 6:15 PM

Lawson recommends that after the installation this file is renamed and moved out of the EFS directory. Its meant as an installation and troubleshooting device but shouldnt be left in place. Additionally you could secure this specific file using Authentication security through your web server. Security hole, security by obscurity or just another "undocumented functionality" perhaps.

Matthew Nye

Veteran Member Send Private Message

Posts: 514

10/21/2010 8:41 PM

Lawson recommends that after the installation this file is renamed and moved out of the EFS directory. Its meant as an installation and troubleshooting device but shouldnt be left in place. Additionally you could secure this specific file using Authentication security through your web server. Security hole, security by obscurity or just another "undocumented functionality" perhaps.