Hosting Controller · Hosting Controller · CVE-2004-1217
Name of the Vulnerable Software and Affected Versions:
Hosting Controller version 6.1 Hotfix 1.4
Description:
The issue allows remote attackers to view arbitrary directories by specifying the target pathname in the `FilePath` parameter to API endpoints such as "Statsbrowse.asp" or "Generalbrowse.asp".
Recommendations:
For Hosting Controller version 6.1 Hotfix 1.4, avoid using the `FilePath` parameter in the affected API endpoints until the issue is resolved. Restrict access to the "Statsbrowse.asp" and "Generalbrowse.asp" pages to minimize the risk of exploitation.