CVE-1999-0910 in Site Server
Summary
by MITRE
Microsoft Site Server and Commercial Internet System (MCIS) do not set an expiration for a cookie, which could then be cached by a proxy and inadvertently used by a different user.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/19/2026
This vulnerability resides in Microsoft Site Server and Commercial Internet System versions that fail to implement proper cookie expiration mechanisms. The flaw occurs when web applications generate authentication or session cookies without setting explicit expiration dates, allowing these cookies to persist indefinitely in the browser cache. When proxy servers intercept and cache these uncached cookies, they maintain the session state for extended periods, creating a significant security risk. The vulnerability is classified under CWE-613 as insufficient session expiration, which directly relates to improper handling of session management components. Attackers can exploit this weakness by intercepting cached cookies through man-in-the-middle attacks or by accessing systems where proxy caching has occurred, potentially gaining unauthorized access to user sessions and accounts.
The technical implementation of this vulnerability stems from the absence of proper cookie attributes during session management. When Microsoft Site Server and MCIS generate cookies, they typically omit the expires or max-age parameters that would normally indicate when a cookie should be discarded by the browser. This omission allows cookies to remain active indefinitely until manually deleted by the user or until the browser session ends. Proxy servers, which are commonly deployed in enterprise environments for performance optimization and security filtering, cache these persistent cookies and store them in memory or on disk. When subsequent requests are made to the same domain, these cached cookies are automatically included in HTTP headers, potentially transferring session information between different users who access the same proxy server. This behavior creates a fundamental flaw in session isolation that violates the principle of least privilege and proper access control enforcement.
The operational impact of this vulnerability extends beyond simple session hijacking to encompass broader security implications within enterprise environments. Organizations using Microsoft Site Server or MCIS may experience unauthorized access to sensitive information, session manipulation, and potential account takeovers when proxy caching occurs. The risk is particularly elevated in shared computing environments where multiple users access the same proxy server or when organizations deploy aggressive caching policies to improve performance. Security teams may find it difficult to trace unauthorized access incidents since the cached cookies can be used by different users who share the same proxy infrastructure. Additionally, this vulnerability undermines the security posture of web applications by creating persistent session tokens that remain valid long after legitimate user sessions should have expired, effectively extending the window of opportunity for malicious actors to exploit compromised sessions.
Mitigation strategies for this vulnerability should focus on implementing proper cookie management practices and enhancing proxy server configurations. Organizations must ensure that all session cookies generated by Microsoft Site Server and MCIS applications include appropriate expiration dates through the use of the expires or max-age attributes in HTTP cookie headers. The implementation should follow industry best practices for session management as outlined in the OWASP Session Management Cheat Sheet, which recommends setting short expiration times and implementing proper session invalidation mechanisms. Network administrators should configure proxy servers to handle session cookies more carefully by implementing cookie scrubbing policies that either strip session identifiers from cached content or enforce stricter cache control policies for authenticated sessions. Additionally, organizations should consider implementing additional authentication layers such as multi-factor authentication and regular session validation checks to reduce the risk of exploitation. The vulnerability demonstrates the importance of adhering to secure coding practices and proper session management as outlined in the ATT&CK framework under the credential access and privilege escalation domains, where the persistence of session tokens creates opportunities for unauthorized access through indirect attack vectors.