PT-2004-2165 · Hosting Controller · Hosting Controller

Mouse · Published 2004-12-15 · Updated 2017-07-11 · CVE-2004-1217

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Hosting Controller version 6.1 Hotfix 1.4

Description: The issue allows remote attackers to view arbitrary directories by specifying the target pathname in the FilePath parameter to API endpoints such as "Statsbrowse.asp" or "Generalbrowse.asp".

Recommendations: For Hosting Controller version 6.1 Hotfix 1.4, avoid using the FilePath parameter in the affected API endpoints until the issue is resolved. Restrict access to the "Statsbrowse.asp" and "Generalbrowse.asp" pages to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2004-1217

Affected Products

Hosting Controller

References · 5

• 🔥 https://exploit-db.com/exploits/675 · Exploit
• 🔥 http://securityfocus.com/bid/11822 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-1217 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18363 · Note
• http://marc.info/?l=bugtraq&m=110237762807764&w=2 · Note