CVE-1999-1246: Direct Mailer feature in Microsoft Site Server 3.0 saves user domain names and passwords in plaintext in th...

Security readout for executives and security teams

Microsoft Site Server 3.0's Direct Mailer could store Windows domain names and passwords in plaintext on a network share with weak default permissions. Anyone who can reach and read that share could collect credentials and potentially escalate privileges. Treat exposure as legacy-system credential risk, not a broad modern Microsoft platform issue. Likely limited to environments still running Microsoft Site Server 3.0 with the Direct Mailer feature and reachable TMLBQueue share. The source bundle's affected-product metadata is incomplete, so exposure should be confirmed through asset inventory and host configuration review. Prioritize if legacy Microsoft Site Server remains in production or connected to domain resources. The business risk is credential disclosure leading to privilege gain. If no such systems exist, document non-exposure and deprioritize. Mitigation focus: Check Microsoft advisory Q229972 for vendor-supported remediation guidance.; Identify and retire any Microsoft Site Server 3.0 Direct Mailer deployments.; Restrict TMLBQueue network share access to required service accounts only..

Prepared

Jul 1, 2026, 08:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.