A vulnerability has been reported in TimeLive, which can be exploited by malicious people to disclose sensitive information.
Input passed via the "FileName" parameter to Shared/FileDownload.aspx is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary files via directory traversal attacks.
The vulnerability is reported in 4.2.1. Other versions may also be affected.
Vulnerable Products
Vulnerable Software: TimeLive 4.x
Solution
Filter malicious characters and character sequences using a proxy.
