CVE-1999-1233

High

Published: 31/12/1999(UTC)Updated: 16/06/2026(UTC)Translated: 17/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

5.45%

92th percentile - higher than 92% of all known CVEs

Summary

IIS 4.0 does not properly restrict access for the initial session request from a user's IP address if the address does not resolve to a DNS domain. This is known as the 'Domain Resolution' vulnerability.

Risk Assessment

The organization may be exposed to unauthorized access to resources, potentially leading to data leaks or other security incidents.

Recommendation

It is recommended to upgrade to a newer version of IIS or implement additional security mechanisms to restrict access based on IP addresses.

Original NVD description (English source)

IIS 4.0 does not properly restrict access for the initial session request from a user's IP address if the address does not resolve to a DNS domain, aka the "Domain Resolution" vulnerability.