CVE-2006-6814

Directory traversal vulnerability in FolderManager/FolderManager.aspx in Hosting Controller 7c allows remote authenticated users to read and modify arbitrary files, and list arbitrary directories via ..\ (dot dot backslash) sequences in the BrowsePath parameter.

CVSS v2.0 6.3 MEDIUM

6.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:S/C:C/I:N/A:N

Exploitability : 6.8 / Impact : 6.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://secunia.com/advisories/23585
http://securitytracker.com/id?1017447	Exploit
http://www.kapda.ir/advisory-458.html	Exploit Vendor Advisory
http://www.securityfocus.com/bid/21786	Exploit
http://www.vupen.com/english/advisories/2007/0023
http://secunia.com/advisories/23585
http://securitytracker.com/id?1017447	Exploit
http://www.kapda.ir/advisory-458.html	Exploit Vendor Advisory
http://www.securityfocus.com/bid/21786	Exploit
http://www.vupen.com/english/advisories/2007/0023

Configurations

Configuration 1 (hide)

cpe:2.3:a:hosting_controller:hosting_controller:7c:*:*:*:*:*:*:*

History

21 Nov 2024, 00:23

Type	Values Removed	Values Added
References	~~() http://secunia.com/advisories/23585 -~~	() http://secunia.com/advisories/23585 -
References	~~() http://securitytracker.com/id?1017447 - Exploit~~	() http://securitytracker.com/id?1017447 - Exploit
References	~~() http://www.kapda.ir/advisory-458.html - Exploit, Vendor Advisory~~	() http://www.kapda.ir/advisory-458.html - Exploit, Vendor Advisory
References	~~() http://www.securityfocus.com/bid/21786 - Exploit~~	() http://www.securityfocus.com/bid/21786 - Exploit
References	~~() http://www.vupen.com/english/advisories/2007/0023 -~~	() http://www.vupen.com/english/advisories/2007/0023 -

Information

Published : 2006-12-29 11:28

Updated : 2024-11-21 00:23

NVD link : CVE-2006-6814

Mitre link : CVE-2006-6814

CVE.ORG link : CVE-2006-6814

JSON object : View

Products Affected

hosting_controller

hosting_controller

CWE

NVD-CWE-Other

{"id": "CVE-2006-6814", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:C/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2006-12-29T11:28:00.000", "references": [{"url": "http://secunia.com/advisories/23585", "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id?1017447", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.kapda.ir/advisory-458.html", "tags": ["Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/21786", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2007/0023", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/23585", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://securitytracker.com/id?1017447", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.kapda.ir/advisory-458.html", "tags": ["Exploit", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/21786", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.vupen.com/english/advisories/2007/0023", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in FolderManager/FolderManager.aspx in Hosting Controller 7c allows remote authenticated users to read and modify arbitrary files, and list arbitrary directories via ..\\ (dot dot backslash) sequences in the BrowsePath parameter."}, {"lang": "es", "value": "Vulnerabilidad de escalado de directorio en FolderManager/FolderManager.aspx en Hosting Controller 7c permite a atacantes remotos autenticados leer y modificar ficheros de su elecci\u00f3n, y listar directorios de su elecci\u00f3n mediante secuencias ..\\ (punto punto barra-invertida) a trav\u00e9s del par\u00e1metro BrowsePath."}], "lastModified": "2024-11-21T00:23:42.893", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hosting_controller:hosting_controller:7c:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "19D358FF-ED54-459C-94ED-3FCCF7A4F4DB"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}