Cuss and discuss:

http://www.net-security.org/vuln.php?id=2765

Looks like it requires a logged in user to work, but any logged in user can make it work (IE, users)

-David