PT-2002-1797 · Hosting Controller · Hosting Controller

Published 2002-08-12 · Updated 2008-09-05 · CVE-2002-0776

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Hosting Controller version 2002

Description: The issue allows remote attackers to change the passwords of arbitrary users and gain privileges by modifying the username parameter in the "getuserdesc.asp" file.

Recommendations: For Hosting Controller version 2002, apply the "UpdateUser" hot fix to resolve the issue. As a temporary workaround, consider restricting access to the "getuserdesc.asp" file to minimize the risk of exploitation. Avoid using the username parameter in the affected file until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2002-0776

Affected Products

Hosting Controller

References · 5

• 🔥 http://online.securityfocus.com/archive/1/282129 · Exploit
• http://hostingcontroller.com/english/logs/sp2log.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0776 · Security Note
• http://iss.net/security_center/static/9554.php · Note
• http://securityfocus.com/bid/5229 · Note