Vulnerabilities > CVE-2002-0421 - Unspecified vulnerability in Microsoft Windows NT 4.0

047910
CVSS 5.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
PARTIAL
Availability impact
NONE
network
low complexity
microsoft
nessus
NVD
Published: 2002-08-12
Updated: 2008-09-05

Summary

IIS 4.0 allows local users to bypass the "User cannot change password" policy for Windows NT by directly calling .htr password changing programs in the /iisadmpwd directory, including (1) aexp2.htr, (2) aexp2b.htr, (3) aexp3.htr , or (4) aexp4.htr.

Vulnerable Configurations

Part Description Count
OS
Microsoft
8

Nessus

NASL familyWeb Servers
NASL idIIS_AUTHENTIFICATION_MANAGER.NASL
descriptionMicrosoft IIS installs the
last seen2020-06-01
modified2020-06-02
plugin id10371
published2000-04-15
reporterThis script is Copyright (C) 2000-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/10371
titleMicrosoft IIS /iisadmpwd/aexp2.htr Password Policy Bypass

References