Remote Password Manipulation in Microsoft Internet Information Services

CVE-2008-4301

Summary

A flaw exists in the ActiveX control within the iisext.dll of Microsoft Internet Information Services (IIS), which may allow unauthorized remote attackers to manipulate passwords using a crafted string argument for the SetPassword method. This vulnerability raises concerns about the potential for unauthorized access to sensitive information and system control. It's important to note that the issue has faced challenges in replication by third-party researchers, casting doubt on earlier reports of its validity.

References