Microsoft IIS 5.1 Frontpage Extensions Path Disclosure Information Vulnerabil

An issue has been reported that a number of configuration files (.cnf) in Microsoft IIS 5.1, could be used to disclose sensitive system information to remote users.


Allegedly, submitting a request for one of the vulnerable files by way of '/_vti_pvt/', will cause the host to reveal system path information. The reported problematic files are 'access.cnf', 'botinfs.cnf', 'bots.cnf' and 'linkinfo.cnf'.

Microsoft has not confirmed the existence of these vulnerabilities.

Remote: Yes

Exploit: No exploit code is required.