Description

When IIS 2 or 3 is upgraded to IIS 4, ism.dll is inadvertently left in /scripts/iisadmin, which does not restrict access to the local machine and allows an unauthorized user to gain access to sensitive server information, including the Administrator's password.

Remediation

References

CVE-1999-1538

Related Vulnerabilities

MediaWiki Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2014-5241)

EspoCRM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-14549)

WordPress Plugin ARForms:Wordpress Form Builder Arbitrary File Deletion (3.7.1)

Sqlite Use After Free Vulnerability (CVE-2021-20227)

MyBB Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2015-4552)

Severity

Low

Classification

CVE-1999-1538

Tags

Missing Update Known Vulnerabilities