vendor:
Personal Web Server and Front Page Personal Web Server
by:
SecurityFocus
2.6
CVSS
LOW
Directory Traversal
22
CWE
Product Name: Personal Web Server and Front Page Personal Web Server
Affected Version From: Windows 95
Affected Version To: Windows 98
Patch Exists: N/A
Related CWE: N/A
CPE: microsoft:personal_web_server
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Windows 9x
1999
Microsoft Personal Web Server and Front Page Personal Web Server ‘/…./’ Directory Traversal Vulnerability
Microsoft's Personal Web Server and Front Page Personal Web Server will follow '/..../' strings in requested URLs, allowing remote users to obtain unauthenticated read access to files and directories on the same logical drive as the web content. Hidden files are viewable via this method, although the Front Page directory itself is not. The name and path of the desired file must be known to the attacker. Note that while these programs support Windows 95, 98 and NT, only the Win9x versions are vulnerable.
Mitigation:
Ensure that the web server is not running on Windows 9x systems.
