Vulnerabilities > CVE-1999-0407 - Unspecified vulnerability in Microsoft Internet Information Server 4.0

047910
CVSS 10.0 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
low complexity
microsoft
critical
nessus
NVD
Published: 1999-02-09
Updated: 2016-10-18

Summary

By default, IIS 4.0 has a virtual directory /IISADMPWD which contains files that can be used as proxies for brute force password attacks, or to identify valid users on the system.

Vulnerable Configurations

Part Description Count
Application
Microsoft
1

Nessus

NASL familyWeb Servers
NASL idIIS_AUTHENTIFICATION_MANAGER.NASL
descriptionMicrosoft IIS installs the
last seen2020-06-01
modified2020-06-02
plugin id10371
published2000-04-15
reporterThis script is Copyright (C) 2000-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/10371
titleMicrosoft IIS /iisadmpwd/aexp2.htr Password Policy Bypass

References