PT-1999-1131 · Microsoft+1 · Iis+1

Published 1999-01-01 · Updated 2022-08-17 · CVE-1999-0448

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IIS version 4.0 Apache (affected versions not specified)

Description The issue allows a remote attacker to hide the URL they are requesting by taking advantage of how IIS 4.0 and Apache log HTTP request methods, regardless of their length.

Recommendations For IIS version 4.0, update the logging configuration to properly handle and log HTTP request methods. For Apache, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-1999-0448

Affected Products

Apache

Iis

References · 4

• 🔥 https://exploit-db.com/exploits/19149 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-1999-0448 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0448 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-1999-0448 · Note