CVE-2002-0421

Published: Aug 12, 2002Modified: Apr 16, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

IIS 4.0 allows local users to bypass the "User cannot change password" policy for Windows NT by directly calling .htr password changing programs in the /iisadmpwd directory, including (1) aexp2.htr, (2) aexp2b.htr, (3) aexp3.htr , or (4) aexp4.htr.

Affected (8)

Products: Microsoft: Windows Nt

Microsoft

1 product

Windows Nt

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Microsoft Windows Nt	Version 4.0
Microsoft Windows Nt	Version 4.0 sp1
Microsoft Windows Nt	Version 4.0 sp2
Microsoft Windows Nt	Version 4.0 sp3
Microsoft Windows Nt	Version 4.0 sp4
Microsoft Windows Nt	Version 4.0 sp5
Microsoft Windows Nt	Version 4.0 sp6
Microsoft Windows Nt	Version 4.0 sp6a