CVE-2007-6502

Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to obtain sensitive information via (1) the AdminName and AdminLevel…

published December 20, 2007

CVSS
—
EPSS
3%
Percentile
86.0
In the wild
Unconfirmed
What it is

Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to obtain sensitive information via (1) the AdminName and AdminLevel parameters to fp2000/NEWSRVR.asp, which discloses usernames; and (2) certain XML HTTP requests to hosting/css.asp using Microsoft.XMLHTTP or MSXML2.XMLHTTP objects, which trigger a response with the setup directory pathname in the HTML source; and (3) might allow remote attackers to obtain sensitive information via a request for /admin/forum/, which reveals the path in an error message when a forum is not found.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02750 · 86.0th percentile
Published
2007-12-20T20:00Z
EPSS history
Timeline
  • 20 DEC 20:00Z
    Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to obtain sensitive information via (1) the AdminName and AdminLevel…
    cvelistv5