CVE-1999-1591
Microsoft Internet Information Services (IIS) server 4.0 SP4, without certain hotfixes released for SP4, does not require authentication credentials under certain conditions, which allows remote attackers to bypass authentication requirements, as…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 11.3%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
Microsoft Internet Information Services (IIS) server 4.0 SP4, without certain hotfixes released for SP4, does not require authentication credentials under certain conditions, which allows remote attackers to bypass authentication requirements, as demonstrated by connecting via Microsoft Visual InterDev 6.0.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 11.27% probability · 96th percentile
- CISA KEV
- Not listed
- Affected
- microsoft/internet information server · microsoft/visual interdev
- Source
- cve@mitre.org
References
- http://archives.neohapsis.com/archives/ntbugtraq/1998-1999/msg00276.html
- http://archives.neohapsis.com/archives/ntbugtraq/1998-1999/msg00277.html
- http://www.securityfocus.com/bid/190
- http://archives.neohapsis.com/archives/ntbugtraq/1998-1999/msg00276.html
- http://archives.neohapsis.com/archives/ntbugtraq/1998-1999/msg00277.html
- http://www.securityfocus.com/bid/190
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.