Detections
Analytics
Microsoft IIS / Site Server codebrws.asp Arbitrary Source Disclosure
medium Nessus Plugin ID 10956
Language:
Synopsis
Some files may be read on the remote host.Description
Microsoft's IIS 5.0 web server is shipped with a set of sample files to demonstrate different features of the ASP language. One of these sample files allows a remote user to view the source of any file in the web root with the extension .asp, .inc, .htm, or .html.Solution
Apply the patch referenced above.See Also
https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/1999/ms99-013
Plugin Details
Severity: Medium
ID: 10956
File Name: iis_codebrws.nasl
Version: 1.26
Type: remote
Family: Web Servers
Published: 5/22/2002
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
Vulnerability Information
CPE: cpe:/a:microsoft:iis
Required KB Items: www/ASP
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 5/7/1999
Reference Information
CVE: CVE-1999-0739
BID: 167