Security readout for executives and security teams
Plain-English summary
CVE-1999-0984 is a command execution flaw in Matt's Whois CGI program. If the old whois.cgi script is exposed, an attacker could use crafted domain input to run commands on the web server. No source in the bundle shows active exploitation or a named patch.
Executive priority
Prioritize remediation if any public-facing whois.cgi instance exists. Remote command execution on a web server can lead to server compromise, data exposure, or pivoting, even though this CVE is old and current exploitation is not confirmed.
Technical view
The CVE describes improper handling of shell metacharacters in the domain entry field of Matt's Whois whois.cgi. Because the CGI appears to pass user-controlled input into shell execution, remote attackers may execute operating-system commands in the web server context.
Likely exposure
Exposure is most likely on legacy websites still hosting Matt's Whois whois.cgi. Modern systems are unlikely to be affected unless this old CGI script was retained, copied, or bundled into a custom web tool.
Exploitation context
The provided sources state remote command execution is possible. CISA KEV is false, and the bundle provides no evidence of current active exploitation, public exploit use, affected versions, or a vendor-confirmed fix.
Researcher notes
The record is sparse: no CVSS, CWE, affected version list, or patch metadata is provided. Treat the description as credible for command injection risk, but validate exposure by confirming the specific Matt's Whois CGI script is present and reachable.
Mitigation direction
- Inventory and remove exposed Matt's Whois whois.cgi deployments.
- Disable the CGI script if removal is not immediately possible.
- Restrict access to trusted networks while replacement work proceeds.
- Replace the script with a maintained WHOIS implementation.
- Check vendor or archive guidance for any confirmed fixed release.
Validation and detection
- Search web roots for whois.cgi and Matt's Whois references.
- Confirm whether the script is reachable from untrusted networks.
- Review source handling of the domain entry field.
- Check logs for suspicious metacharacter input attempts.
- Document any legacy dependencies before removal or replacement.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-1999-0984 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-1999-0984CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.