Microsoft Internet Explorer 4.01 File Upload Control privileges management

Summaryinfo

A vulnerability labeled as critical has been found in Microsoft Internet Explorer 4.01. Affected by this vulnerability is an unknown functionality of the component File Upload Control Handler. Such manipulation leads to privileges management. This vulnerability is traded as CVE-1999-0870. The attack may be launched remotely. There is no exploit available. This vulnerability has historical importance owing to its background and reception. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability was found in Microsoft Internet Explorer 4.01 (Web Browser) and classified as critical. Affected by this issue is an unknown part of the component File Upload Control Handler. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality. CVE summarizes:

Internet Explorer 4.01 allows remote attackers to read arbitrary files by pasting a file name into the file upload control, aka untrusted scripted paste.

The issue has been introduced in 11/18/1997. The weakness was shared 10/01/1998 as MS98-015 as confirmed security bulletin (Website). The advisory is available at microsoft.com. This vulnerability is handled as CVE-1999-0870. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 04/17/2026). It is expected to see the exploit prices for this product decreasing in the near future.This vulnerability is assigned to T1068 by the MITRE ATT&CK project. This vulnerability has a historic impact due to its background and reception.

The vulnerability was handled as a non-public zero-day exploit for at least 317 days. During that time the estimated underground price was around $25k-$100k.

Upgrading to version 5.0 eliminates this vulnerability. Applying the patch MS98-015 is able to eliminate this problem. The bugfix is ready for download at microsoft.com. The best possible mitigation is suggested to be patching the affected component.

The vulnerability is also documented in the databases at X-Force (2213) and Vulnerability Center (SBV-4326†). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Web Browser

Vendor

• Microsoft

Name

• Internet Explorer

Version

• 4.01

License

• commercial

Support

• end of life

Website

• Vendor: https://www.microsoft.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion