Information Disclosure Vulnerability in Index Server 2.0 by Microsoft

CVE-1999-1397

Summary

The Index Server 2.0 on IIS 4.0 contains a vulnerability where the physical path information of indexed directories is stored in the ContentIndex\Catalogs subkey of the AllowedPaths registry key. This configuration inadvertently permits both local and remote users to access sensitive directory paths. This exposure can lead to further exploitation, as attackers might use this information to gain unauthorized access to files and resources on the server.

References