CVE-1999-1246 Information disclosure in n/a
Remote attackers can read plaintext credentials from a network share to gain unauthorized privileges in Microsoft Site Server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-1999-1246?
CVE-1999-1246 is a high-severity vulnerability in n/a, published on 9 Mar 2002. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Direct Mailer feature in Microsoft Site Server 3.0 saves user domain names and passwords in plaintext in the TMLBQueue network share, which has insecure default permissions, allowing remote attackers to read the passwords and gain privileges.
Which versions are affected by CVE-1999-1246?
It affects 1 product.
Products include Microsoft Site Server.
How do I fix CVE-1999-1246?
No fix has been published for CVE-1999-1246 yet. Limit exposure of the affected software until one is available.
Is CVE-1999-1246 being exploited?
There is no known exploitation of CVE-1999-1246 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2002-1769 Hardcoded credentials in n/a
- CVE-2000-0161 SQL injection in n/a
- CVE-1999-0360 MS Site Server 2.0 with IIS 4 can allow users to upload content, including ASP, to the target web site, thus allowing them to execute commands remotely.
- CVE-2002-2081 Denial of service in n/a
- CVE-1999-1520 Information disclosure in n/a
Sources
Also known as GHSA-99cm-v3cq-wf9j.