Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:10371
Category:CGI abuses

The file /iisadmpwd/aexp2.htr is present.
(or, aexp2b.htr, aexp3.htr, or aexp4.htr, search for aexp*.htr)

An attacker may use it in a brute force attack
to gain valid username/password.
A valid user may also use it to change his password
on a locked account.

Solution : Delete the file
Risk factor : High

Cross-Ref: BugTraq ID: 2110
BugTraq ID: 4236
Common Vulnerability Exposure (CVE) ID: CVE-1999-0407
Bugtraq: 19990209 ALERT: IIS4 allows proxied password attacks over NetBIOS (Google Search)
Bugtraq: 19990209 Re: IIS4 allows proxied password attacks over NetBIOS (Google Search)
XForce ISS Database: iis-iisadmpwd
Common Vulnerability Exposure (CVE) ID: CVE-2002-0421
Bugtraq: 20020306 NT user (who is locked changing his/her password by administrator ) can bypass the security policy and Change the password. (Google Search)
CopyrightThis script is Copyright (C) 2000 Renaud Deraison

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.

© 1998-2024 E-Soft Inc. All rights reserved.