Detections
Analytics

Microsoft IIS WebDAV SEARCH Method Arbitrary Directory Forced Listing

medium Nessus Plugin ID 10526

Synopsis

The remote service is vulnerable to inforamtion disclosure.

Description

It is possible to retrieve the listing of the remote directories accessible via HTTP, rather than their index.html, using the Index Server service which provides WebDav capabilities to this server.

This problem allows an attacker to gain more knowledge about the remote host, and may make him aware of hidden HTML files.

Solution

Disable the Index Server service.

See Also

https://support.microsoft.com/en-us/help/272079

Plugin Details

Severity: Medium

ID: 10526

File Name: webdav_iis.nasl

Version: 1.25

Type: remote

Family: Web Servers

Published: 10/5/2000

Updated: 11/15/2018

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.2

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 10/4/2000

Reference Information

CVE: CVE-2000-0951

BID: 1756