Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

Microsoft Index Server reveals real web directory path

CVE-2000-0098 · published 26 years ago
Summary

Microsoft Index Server can be tricked into revealing the actual location of a web folder when a specially crafted request is sent for a missing data file. This lets an attacker learn the true directory structure, which can aid further attacks. Apply the latest security updates from Microsoft or disable the Index Server feature if it is not needed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
microsoft index_server 2.0
cpe:2.3:a:microsoft:index_server:2.0:*:*:*:*:*:*:*
Original advisory text
Microsoft Index Server allows remote attackers to determine the real path for a web directory via a request to an Internet Data Query file that does not exist.
Microsoft Index Server allows remote attackers to determine the real path for a web directory via a request to an Internet Data Query file that does not exist.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
49% chance of attack within 30 days
Timeline
Published26 Jan 2000
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2000-0098 · NVD
Track software like this
Free during beta