CVE-2003-1566 - Vulnerability Details - OpenCVE

Microsoft Internet Information Services (IIS) 5.0 does not log requests that use the TRACK method, which allows remote attackers to obtain sensitive information without detection.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.09301.

Key SSVC decision points have not yet been added.

Vendors	Products
Microsoft	Internet Information Services

Configuration 1 [-]

cpe:2.3:a:microsoft:internet_information_services:5.0:*:*:*:*:*:*:*

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://archives.neohapsis.com/archives/ntbugtraq/2003-q4/0321.html
http://www.aqtronix.com/Advisories/AQ-2003-02.txt
http://www.osvdb.org/4864
http://www.securityfocus.com/bid/9313
https://exchange.xforce.ibmcloud.com/vulnerabilities/14077

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2009-01-15T00:00:00

Updated: 2024-08-08T02:35:17.508Z

Reserved: 2009-01-14T00:00:00

Link: CVE-2003-1566

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2009-01-15T00:30:00.233

Modified: 2025-04-09T00:30:58.490

Link: CVE-2003-1566

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2003-12-27T00:00:00", "descriptions": [{"lang": "en", "value": "Microsoft Internet Information Services (IIS) 5.0 does not log requests that use the TRACK method, which allows remote attackers to obtain sensitive information without detection."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-07T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "20031227 AQ-2003-02: Microsoft IIS Logging Failure", "tags": ["mailing-list", "x_refsource_NTBUGTRAQ"], "url": "http://archives.neohapsis.com/archives/ntbugtraq/2003-q4/0321.html"}, {"name": "4864", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/4864"}, {"name": "iis-improper-httptrack-logging(14077)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14077"}, {"name": "9313", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/9313"}, {"tags": ["x_refsource_MISC"], "url": "http://www.aqtronix.com/Advisories/AQ-2003-02.txt"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2003-1566", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Microsoft Internet Information Services (IIS) 5.0 does not log requests that use the TRACK method, which allows remote attackers to obtain sensitive information without detection."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "20031227 AQ-2003-02: Microsoft IIS Logging Failure", "refsource": "NTBUGTRAQ", "url": "http://archives.neohapsis.com/archives/ntbugtraq/2003-q4/0321.html"}, {"name": "4864", "refsource": "OSVDB", "url": "http://www.osvdb.org/4864"}, {"name": "iis-improper-httptrack-logging(14077)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14077"}, {"name": "9313", "refsource": "BID", "url": "http://www.securityfocus.com/bid/9313"}, {"name": "http://www.aqtronix.com/Advisories/AQ-2003-02.txt", "refsource": "MISC", "url": "http://www.aqtronix.com/Advisories/AQ-2003-02.txt"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-08T02:35:17.508Z"}, "title": "CVE Program Container", "references": [{"name": "20031227 AQ-2003-02: Microsoft IIS Logging Failure", "tags": ["mailing-list", "x_refsource_NTBUGTRAQ", "x_transferred"], "url": "http://archives.neohapsis.com/archives/ntbugtraq/2003-q4/0321.html"}, {"name": "4864", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/4864"}, {"name": "iis-improper-httptrack-logging(14077)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14077"}, {"name": "9313", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/9313"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.aqtronix.com/Advisories/AQ-2003-02.txt"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2003-1566", "datePublished": "2009-01-15T00:00:00", "dateReserved": "2009-01-14T00:00:00", "dateUpdated": "2024-08-08T02:35:17.508Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:internet_information_services:5.0:*:*:*:*:*:*:*", "matchCriteriaId": "413C07EA-139F-4B7D-A58B-835BD2591FA0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Microsoft Internet Information Services (IIS) 5.0 does not log requests that use the TRACK method, which allows remote attackers to obtain sensitive information without detection."}, {"lang": "es", "value": "Microsoft Internet Information Services (IIS) v5.0 no registra las peticiones que usan el m\u00e9todo TRACK, lo que permite a atacantes remotos obtener informaci\u00f3n sensible sin ser detectados."}], "id": "CVE-2003-1566", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2009-01-15T00:30:00.233", "references": [{"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://archives.neohapsis.com/archives/ntbugtraq/2003-q4/0321.html"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.aqtronix.com/Advisories/AQ-2003-02.txt"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/4864"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/9313"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14077"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://archives.neohapsis.com/archives/ntbugtraq/2003-q4/0321.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.aqtronix.com/Advisories/AQ-2003-02.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/4864"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/9313"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14077"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-16"}], "source": "nvd@nist.gov", "type": "Primary"}]}