CVE-1999-0372 Hardcoded credentials in n/a
Attackers can read hardcoded credentials from the installer's reboot.ini file to gain unauthorized access to the BackOffice Server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-1999-0372?
CVE-1999-0372 is a low-severity vulnerability in Microsoft Windows 2000, published on 29 Sep 1999. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The installer for BackOffice Server includes account names and passwords in a setup file (reboot.ini) which is not deleted.
Weakness: CWE-200
Which versions are affected by CVE-1999-0372?
It affects 3 products.
Products include Microsoft Backoffice, Microsoft Windows 2000, Microsoft Windows Nt.
How do I fix CVE-1999-0372?
No fix has been published for CVE-1999-0372 yet. Limit exposure of the affected software until one is available.
Is CVE-1999-0372 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-1999-0372 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Microsoft Windows 2000
Sources
Also known as GHSA-gcm6-ww8r-qm6x.