CVE-1999-1397
Index Server 2.0 on IIS 4.0 stores physical path information in the ContentIndex\Catalogs subkey...
Index Server 2.0 on IIS 4.0 stores physical path information in the ContentIndex\Catalogs subkey of the AllowedPaths registry key, whose permissions allows local and remote users to obtain the physical paths of directories that are being indexed.
Exploit likelihood
What each source reports
NVD Score used
Index Server 2.0 on IIS 4.0 stores physical path information in the ContentIndex\Catalogs subkey of the AllowedPaths registry key, whose permissions allows local and remote users to obtain the physical paths of directories that are being indexed.
- Record
CVE-1999-1397- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Index Server 2.0 on IIS 4.0 stores physical path information in the ContentIndex\Catalogs subkey of the AllowedPaths registry key, whose permissions allows local and remote users to obtain the physical paths of directories that are being indexed.
- Record
CVE-1999-1397- Updated
- 2026-11-02
EUVDEUVD-1999-1378 No score
Index Server 2.0 on IIS 4.0 stores physical path information in the ContentIndex\Catalogs subkey of the AllowedPaths registry key, whose permissions allows local and remote users to obtain the physical paths of directories that are being indexed.
- Record
EUVD-1999-1378- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vvqj-w228-7466 No score
Index Server 2.0 on IIS 4.0 stores physical path information in the ContentIndex\Catalogs subkey...
Index Server 2.0 on IIS 4.0 stores physical path information in the ContentIndex\Catalogs subkey of the AllowedPaths registry key, whose permissions allows local and remote users to obtain the physical paths of directories that are being indexed.
- Record
GHSA-vvqj-w228-7466- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-1999-1397 is a high vulnerability (CVSS 7.5) in Microsoft Index Server, published March 23, 1999. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 11.7%, the 96th percentile. No source names a fixed version.