Vulnerability in Microsoft Windows Nt

CVE-2002-0421

IIS 4.0 allows local users to bypass the "User cannot change password" policy for Windows NT by directly calling .htr password changing programs in the /iisadmpwd directory, including (1) aexp2.htr, (2) aexp2b.htr, (3) aexp3.htr , or (4) aexp4.htr.

EPSS: 0.200 (97.2th percentile) — read the EPSS interpretation.

Affected products

Microsoft Windows_nt — versions 4.0
N/a — versions n/a

References

cve@mitre.org (Patch, vdb-entry, Vendor Advisory, x_refsource_XF)
cve@mitre.org (Vendor Advisory, mailing-list, x_refsource_BUGTRAQ)
cve@mitre.org (Patch, vdb-entry, x_refsource_BID, Vendor Advisory)