VULNERABILITY INTELLIGENCE

CVE-2002-0421

CVSS score5 MEDIUM
EPSS probability20.04%
CISA KEVNot currently listed
Published2002-08-12
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:N/C:N/I:P/A:N

Description

IIS 4.0 allows local users to bypass the "User cannot change password" policy for Windows NT by directly calling .htr password changing programs in the /iisadmpwd directory, including (1) aexp2.htr, (2) aexp2b.htr, (3) aexp3.htr , or (4) aexp4.htr.

Primary references