CVE-2007-6502 describes multiple information disclosure vulnerabilities in Hosting Controller 6.1 Hot fix 3.3 and earlier. Authenticated attackers can retrieve usernames via specific parameters to NEWSRVR.asp, disclose the setup directory pathname through crafted XML HTTP requests to css.asp, and potentially reveal path information via error messages from requests to /admin/forum/. With a CVSS score of 5.5 (medium), this vulnerability has a low attack complexity and requires authentication, allowing partial confidentiality and integrity impact. The FAUCET Risk Score is 76/100, indicating a moderate risk. There is no evidence of active exploitation, and it is not listed in the KEV catalog. While an ExploitDB entry exists, there are no Metasploit or Nuclei modules, and community discussion and media coverage are minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 6.1_hotfix_3.3CPE matchmatch criteria | cpe:2.3:a:hosting_controller:hosting_controller:*:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:S/C:P/I:P/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.