What’s Vulnerable › Vulnerabilities

CVE-1999-1397

• Severity: high (CVSS 7.5 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 11.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2004-09-01 · updated 2026-06-16

Description

Index Server 2.0 on IIS 4.0 stores physical path information in the ContentIndex\Catalogs subkey of the AllowedPaths registry key, whose permissions allows local and remote users to obtain the physical paths of directories that are being indexed.

Affected products

• Microsoft Index Server: 2.0

References

• http://marc.info/?l=bugtraq&m=92242671024118&w=2
• http://marc.info/?l=ntbugtraq&m=92223293409756&w=2
• http://www.iss.net/security_center/static/7559.php
• http://www.securityfocus.com/bid/476
• http://marc.info/?l=bugtraq&m=92242671024118&w=2
• http://marc.info/?l=ntbugtraq&m=92223293409756&w=2
• http://www.iss.net/security_center/static/7559.php
• http://www.securityfocus.com/bid/476

Get alerted when CVE-1999-1397 or the next vulnerability affects your stack