The component in (1) /luci/homebase and (2) /luci/cluster menu in Red Hat Conga 0.12.2 allows remote authenticated users to bypass intended access restrictions via a crafted URL.

Red Hat Conga 0.12.2 allows remote attackers to obtain sensitive information via a crafted request to the (1) homebase, (2) cluster, (3) storage, (4) portalskins/custom, or (5) logs Luci extension.

Common Vulnerabilities and Exposures assigned an identifier CVE-2011-0720 to the following vulnerability:

Name: CVE-2011-0720 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0720 Assigned: 20110131 Reference: http://plone.org/products/plone/security/advisories/cve-2011-0720 Reference: http://www.securityfocus.com/bid/46102 Reference: http://secunia.com/advisories/43146 Reference: http://xforce.iss.net/xforce/xfdb/65099

Unspecified vulnerability in Plone 2.5 through 4.0 allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors.

The hotfix for this issue is available here: http://plone.org/products/plone-hotfix/releases/CVE-2011-0720/

Some Plone components are included in conga, so this flaw may have some impact there.

A security flaw was found in the way Luci administration application processed ticket cookies. A remote attacker, with certain knowledge of running Luci instance environment details could use this flaw to bypass standard Luci authentication mechanism (access resources which should be otherwise protected by authentication).