CVE-1999-1071
HighExploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Excite for Web Servers (EWS) 1.1 installs the Architext.conf authentication file with world-writeable permissions, allowing local users to gain access to Excite accounts by modifying the file.
Risk Assessment
Local users may gain unauthorized access to Excite accounts, posing a serious threat to data security.
Recommendation
It is recommended to change the permissions of the Architext.conf file to restrict access to authorized users only.
Other vulnerabilities in Excite for Web Servers (EWS) 1.1
See all- CVE-1999-1073High
Excite for Web Servers (EWS) 1.1 records the first two characters of a plaintext password at the beginning of the encrypted password, making it easier for attackers to guess passwords via brute force or dictionary attacks.
- CVE-1999-1072High
Excite for Web Servers (EWS) version 1.1 allows local users to gain privileges by obtaining the encrypted password from the world-readable Architext.conf authentication file and replaying the encrypted password in an HTTP request to AT-generated.cgi or AT-admin.cgi.
- CVE-1999-0279High
Excite for Web Servers (EWS) allows remote command execution via shell metacharacters.
Original NVD description (English source)
Excite for Web Servers (EWS) 1.1 installs the Architext.conf authentication file with world-writeable permissions, which allows local users to gain access to Excite accounts by modifying the file.