low2.1Public exploit code
CVE-1999-1538
When IIS 2 or 3 is upgraded to IIS 4, ism.dll is inadvertently left in /scripts/iisadmin, which does not restrict access to the local machine and allows an una…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Microsoft IIS 4 (Windows NT) - Remote Web-Based Administration1999-01-14 · remote · windows · Verified
Impact
When IIS 2 or 3 is upgraded to IIS 4, ism.dll is inadvertently left in /scripts/iisadmin, which does not restrict access to the local machine and allows an unauthorized user to gain access to sensitive server information, including the Administrator's password.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Internet Information Server | Version 4.0 |