PT-2001-2137 · Microsoft · Index Server

Publicado 2001-09-14 · Atualizado 2017-12-19 · CVE-2001-0986

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Index Server 2.0

Description The issue allows remote attackers to obtain sensitive information, including the physical path, file attributes, or portions of source code, by directly calling the SQLQHit.asp sample file with a specific CiScope parameter set to values such as webinfo, extended fileinfo, extended webinfo, or fileinfo.

Recommendations For Microsoft Index Server 2.0, consider restricting access to the SQLQHit.asp sample file to prevent direct calls with sensitive CiScope parameters until a fix is available. As a temporary workaround, avoid using the CiScope parameter with values that could expose sensitive information.

Exploit

Correção

Identificadores relacionados

CVE-2001-0986

Produtos afetados

Index Server

Referências · 5

• 🔥 https://exploit-db.com/exploits/21113 · Exploit
• 🔥 http://securityfocus.com/bid/3339 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2001-0986 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7125 · Nota
• http://securityfocus.com/archive/1/214217 · Aviso do Fabricante