CVE-1999-1246

CVE-1999-1246 describes a critical vulnerability in Microsoft Site Server 3.0's Direct Mailer feature. This flaw causes user domain names and passwords to be stored in plaintext within the TMLBQueue network share, which is accessible due to insecure default permissions. The vulnerability has a CVSS score of 7.5 (HIGH), indicating that unauthenticated remote attackers can easily read these credentials, leading to privilege escalation and compromise of confidentiality, integrity, and availability. Despite its severity, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this decades-old vulnerability.