CVE-1999-1397
HighExploitation Probability (EPSS)
Very high risk96th percentile - higher than 96% of all known CVEs
Summary
Index Server 2.0 on IIS 4.0 stores physical path information in the ContentIndex\Catalogs subkey of the AllowedPaths registry key. The permissions of this key allow local and remote users to obtain the physical paths of directories that are being indexed.
Risk Assessment
The organization may be exposed to the disclosure of sensitive information about the directory structure, which could lead to further attacks on the system.
Recommendation
It is recommended to restrict permissions to the AllowedPaths registry key and monitor access to the Index Server.
Original NVD description (English source)
Index Server 2.0 on IIS 4.0 stores physical path information in the ContentIndex\Catalogs subkey of the AllowedPaths registry key, whose permissions allows local and remote users to obtain the physical paths of directories that are being indexed.