CVE-1999-1538

CVE-1999-1538 describes a vulnerability in Microsoft IIS 4, specifically when upgraded from IIS 2 or 3. The upgrade process inadvertently leaves the ism.dll file in the /scripts/iisadmin directory, which lacks proper access restrictions. This oversight allows unauthorized users to remotely access sensitive server information, including the Administrator's password. The vulnerability has a CVSS score of 2.1 (LOW), indicating a local attack vector with low complexity and no authentication required, leading to partial confidentiality impact. Despite the low CVSS score, its EPSS and FAUCET Risk Score suggest a higher potential for exploitation than many other CVEs. While there is no evidence of active exploitation or Metasploit/Nuclei modules, an ExploitDB entry (EDB-19147) exists for remote web-based administration. There is no community discussion or media coverage surrounding this particular CVE.