security hole in LBI - LawsonGuru.com - LawsonGuru.com Forums -

Name	Points
Greg Moeller	4184
David Williams	3349
Kat V	2984
Woozy	1973
Jimmy Chiu	1883
Kwane McNeal	1437
Ragu Raghavan	1377
Roger French	1315
mark.cook	1244
Chris Martin	825

Jimmy Chiu

Veteran Member

Posts: 641

New Poster

9/29/2010 5:49 PM

I just logged this hole with Lawson. Hopefully they will fix it soon.

Anyway, here is the security hole.

Ie: http://server:port/efs/ConfigurationAssistant

No login check, nothing, and you can make changes.

Matthew Nye

Veteran Member

Posts: 514

9/29/2010 6:15 PM

Lawson recommends that after the installation this file is renamed and moved out of the EFS directory. Its meant as an installation and troubleshooting device but shouldnt be left in place. Additionally you could secure this specific file using Authentication security through your web server. Security hole, security by obscurity or just another "undocumented functionality" perhaps.

Matthew Nye

Veteran Member

Posts: 514

10/21/2010 8:41 PM

Lawson recommends that after the installation this file is renamed and moved out
of the EFS directory. Its meant as an installation and troubleshooting device
but shouldnt be left in place. Additionally you could secure this specific file
using Authentication security through your web server. Security hole, security
by obscurity or just another "undocumented functionality" perhaps.