Details of VAR-200809-0441

ID

VAR-200809-0441

CVE

CVE-2008-4301

TITLE

Microsoft's Internet Information Services Vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2008-006675

DESCRIPTION

A certain ActiveX control in iisext.dll in Microsoft Internet Information Services (IIS) allows remote attackers to set a password via a string argument to the SetPassword method. NOTE: this issue could not be reproduced by a reliable third party. In addition, the original researcher is unreliable. Therefore the original disclosure is probably erroneous

Trust: 1.62

sources: NVD: CVE-2008-4301 // JVNDB: JVNDB-2008-006675

AFFECTED PRODUCTS

vendor:	microsoft	model:	internet information services	scope:	eq	version:	-	Trust: 1.0
vendor:	マイクロソフト	model:	internet information services	scope:	eq	version:	-	Trust: 0.8
vendor:	microsoft	model:	iis	scope:	-	version:	-	Trust: 0.6

sources: JVNDB: JVNDB-2008-006675 // CNNVD: CNNVD-200809-405 // NVD: CVE-2008-4301

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2008-4301
value:	HIGH
Trust: 1.0
NVD:	CVE-2008-4301
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-200809-405
value:	CRITICAL
Trust: 0.6

nvd@nist.gov:	CVE-2008-4301
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8

sources: JVNDB: JVNDB-2008-006675 // CNNVD: CNNVD-200809-405 // NVD: CVE-2008-4301

PROBLEMTYPE DATA

problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	Lack of information (CWE-noinfo) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2008-006675 // NVD: CVE-2008-4301

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200809-405

TYPE

trust management problem

Trust: 0.6

sources: CNNVD: CNNVD-200809-405

PATCH

title:

Home

url:

https://www.iis.net/

Trust: 0.8

sources: JVNDB: JVNDB-2008-006675

EXTERNAL IDS

db:	NVD	id:	CVE-2008-4301	Trust: 3.2
db:	JVNDB	id:	JVNDB-2008-006675	Trust: 0.8
db:	CNNVD	id:	CNNVD-200809-405	Trust: 0.6

sources: JVNDB: JVNDB-2008-006675 // CNNVD: CNNVD-200809-405 // NVD: CVE-2008-4301

REFERENCES

url:	http://www.attrition.org/pipermail/vim/2008-october/002081.html	Trust: 2.4
url:	http://www.securityfocus.com/archive/1/496694/100/0/threaded	Trust: 2.4
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/45587	Trust: 1.6
url:	https://nvd.nist.gov/vuln/detail/cve-2008-4301	Trust: 0.8

sources: JVNDB: JVNDB-2008-006675 // CNNVD: CNNVD-200809-405 // NVD: CVE-2008-4301

SOURCES

db:	JVNDB	id:	JVNDB-2008-006675
db:	CNNVD	id:	CNNVD-200809-405
db:	NVD	id:	CVE-2008-4301

LAST UPDATE DATE

2024-11-23T22:39:36.224000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2008-006675	date:	2024-07-23T07:39:00
db:	CNNVD	id:	CNNVD-200809-405	date:	2021-08-16T00:00:00
db:	NVD	id:	CVE-2008-4301	date:	2024-11-21T00:51:20.483

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2008-006675	date:	2024-07-23T00:00:00
db:	CNNVD	id:	CNNVD-200809-405	date:	2008-09-29T00:00:00
db:	NVD	id:	CVE-2008-4301	date:	2008-09-29T17:17:29.253