CVE Catalog
CVE-1999-0407
HighExploitation Probability (EPSS)
Very high risk5.13%
91th percentile - higher than 91% of all known CVEs
Summary
By default, IIS 4.0 has a virtual directory /IISADMPWD which contains files that can be used as proxies for brute force password attacks, or to identify valid users on the system.
Risk Assessment
The presence of this directory poses a security risk, allowing attackers to perform password attacks and identify users, potentially leading to unauthorized access.
Recommendation
It is recommended to remove or block access to the /IISADMPWD directory to minimize the risk associated with password attacks.
Original NVD description (English source)
By default, IIS 4.0 has a virtual directory /IISADMPWD which contains files that can be used as proxies for brute force password attacks, or to identify valid users on the system.