CVE-1999-1397

High CVSS 7.5

Published 1999-03-23 · last changed 2026-06-16

The fix

We hold no Microsoft remediation data for CVE-1999-1397, which normally means it is not a Windows CVE. For non-Microsoft software the fix is the vendor's own updated release, and the affected versions are listed below.

What it is

Index Server 2.0 on IIS 4.0 stores physical path information in the ContentIndex\Catalogs subkey of the AllowedPaths registry key, whose permissions allows local and remote users to obtain the physical paths of directories that are being indexed.

Sources

NVD record for CVE-1999-1397

CVSS vector: AV:N/AC:L/Au:N/C:P/I:P/A:P