Detections
Analytics
Microsoft IIS / Site Server viewcode.asp Arbitrary File Access
medium Nessus Plugin ID 10576
Synopsis
The remote web server is affected by an information disclosure vulnerability.Description
The file viewcode.asp is a default IIS file that can give a malicious user a lot of unnecessary information about your file system or source files. Specifically, viewcode.asp can allow a remote user to potentially read any file on a web server hard drive.Solution
If you do not need these files, then delete them, otherwise use suitable access control lists to ensure that the files are not world-readable.See Also
https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/1999/ms99-013
Plugin Details
Severity: Medium
ID: 10576
File Name: iis_viewcode.nasl
Version: 1.45
Type: remote
Family: Web Servers
Published: 12/11/2000
Updated: 5/28/2024
Configuration: Enable paranoid mode, Enable thorough checks
Supported Sensors: Nessus
Enable CGI Scanning: true
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
Vulnerability Information
CPE: cpe:/a:microsoft:iis
Required KB Items: Settings/ParanoidReport, www/ASP
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 5/7/1999
Reference Information
CVE: CVE-1999-0737
BID: 167