CVE-1999-1073
HighExploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Excite for Web Servers (EWS) 1.1 records the first two characters of a plaintext password at the beginning of the encrypted password, making it easier for attackers to guess passwords via brute force or dictionary attacks.
Risk Assessment
The organization is at risk of unauthorized access to systems, as attackers may more easily guess user passwords.
Recommendation
It is recommended to upgrade to a newer version of the software that does not have this vulnerability and to implement stronger password policies.
Other vulnerabilities in Excite for Web Servers (EWS) 1.1
See all- CVE-1999-1071High
Excite for Web Servers (EWS) 1.1 installs the Architext.conf authentication file with world-writeable permissions, allowing local users to gain access to Excite accounts by modifying the file.
- CVE-1999-1072High
Excite for Web Servers (EWS) version 1.1 allows local users to gain privileges by obtaining the encrypted password from the world-readable Architext.conf authentication file and replaying the encrypted password in an HTTP request to AT-generated.cgi or AT-admin.cgi.
- CVE-1999-0279High
Excite for Web Servers (EWS) allows remote command execution via shell metacharacters.
Original NVD description (English source)
Excite for Web Servers (EWS) 1.1 records the first two characters of a plaintext password in the beginning of the encrypted password, which makes it easier for an attacker to guess passwords via a brute force or dictionary attack.