CVE-1999-1367 in Internet Explorer
Summary
by MITRE
Internet Explorer 5.0 does not properly reset the username/password cache for Web sites that do not use standard cache controls, which could allow users on the same system to access restricted web sites that were visited by other users.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/19/2026
This vulnerability resides in the web browser component of internet explorer version 5.0 and represents a critical security flaw in credential management and cache handling. The issue stems from the browser's improper handling of authentication credentials when accessing web resources that do not implement standard cache control mechanisms. When users navigate to websites that do not explicitly define cache policies, internet explorer fails to properly clear or reset the cached username and password information from previous sessions. This behavior creates a persistent security risk where subsequent users sharing the same system can potentially access restricted web resources that were previously accessed by other individuals. The flaw fundamentally compromises the isolation between user sessions and violates basic security principles of credential separation and access control.
The technical implementation of this vulnerability demonstrates a failure in the browser's session management architecture, specifically in how it handles authentication state transitions between different web resources. When internet explorer encounters a website without standard cache controls, it maintains cached authentication credentials in memory or local storage without proper cleanup mechanisms. This behavior creates a credential leak scenario where sensitive authentication information remains accessible to unauthorized users who may subsequently log into the same system. The vulnerability operates at the application layer and represents a classic case of improper resource cleanup and state management, which aligns with common weakness enumerations such as cwe-200 information exposure and cwe-285 improper authentication. The flaw essentially allows for privilege escalation through credential reuse and session hijacking scenarios.
From an operational perspective, this vulnerability creates significant risks for shared computing environments including corporate workstations, public computer terminals, and multi-user systems. The impact extends beyond simple credential theft to encompass potential data breaches, unauthorized access to confidential information, and compromise of sensitive business or personal data. Attackers can exploit this vulnerability by simply logging into a shared system and attempting to access previously visited restricted websites, bypassing normal authentication requirements. This vulnerability particularly affects environments where multiple users share the same physical or virtual computing resources, making it a serious concern for organizations implementing shared workstations or public computing facilities. The attack vector is straightforward and requires minimal technical expertise, making it particularly dangerous in real-world deployment scenarios.
Mitigation strategies for this vulnerability should focus on implementing proper browser security configurations and user session management practices. Organizations should ensure that internet explorer is configured to clear authentication credentials upon session termination or when transitioning between different web resources. System administrators should consider implementing additional security measures such as disabling automatic authentication cache retention, enforcing strict cache control policies, and implementing user session isolation mechanisms. The vulnerability also highlights the importance of regular browser updates and patches, as newer versions of internet explorer and other modern browsers have addressed similar credential management issues. From a compliance standpoint, this vulnerability would likely violate security standards such as nist 800-53 and iso 27001 requirements for access control and credential management. Organizations should also implement monitoring solutions to detect unauthorized access attempts and credential reuse patterns that could indicate exploitation of this vulnerability.