Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.6

iE Integrator reveals server details through missing page

CVE-2006-0704 · published 20 years ago
Summary

The iE Integrator 4.4.220114 can expose the server’s install path, web server name, IP address, port, session cookies and system username when an error page is not specially configured. Attackers trigger a request for a non‑existent .aspx file and the default error message leaks this information. Configure a custom error page in acm.ini or apply the vendor’s update to stop the data leak.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ie ie_integrator 4.4.220114
cpe:2.3:a:ie:ie_integrator:4.4.220114:*:*:*:*:*:*:*
Original advisory text
iE Integrator 4.4.220114, when configured without a "bespoke error page" in acm.ini, allows remote attackers to obtain sensitive information via a URL that calls a non-existent .aspx script in the ...
iE Integrator 4.4.220114, when configured without a "bespoke error page" in acm.ini, allows remote attackers to obtain sensitive information via a URL that calls a non-existent .aspx script in the integrator/apps directory, which results in an error message that displays the installation path, web server name, IP, and port, session cookie information, and the IIS system username.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
2.6 Low
Exploitation
1% chance of attack within 30 days
Timeline
Published15 Feb 2006
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2006-0704 · NVD
Track software like this
Free during beta