Security readout for executives and security teams
A flaw in WQuinn QuotaAdvisor 4.1, an older Windows disk-quota tool, lets any authenticated user generate a quota report that reveals the names of files and folders on shared servers, even ones they should not be able to see. It exposes directory listings, not file contents, but that inventory alone can help attackers plan further intrusions. Exposure is limited to Windows file servers still running WQuinn QuotaAdvisor 4.1, a legacy quota product from around 2000. Given the product's age and subsequent acquisition of WQuinn by Veritas, live installations in modern enterprises should be rare and are most likely on unsupported legacy Windows Server hosts. Very low priority for most organizations. Treat as a legacy-software hygiene item: confirm the product is not in use, and if it is, plan replacement during normal maintenance rather than as an emergency response. No evidence of active exploitation and impact is limited to file-name disclosure. Mitigation focus: Inventory Windows file servers for any surviving WQuinn QuotaAdvisor 4.1 installations.; Retire QuotaAdvisor 4.1 in favor of a supported quota solution such as Windows FSRM.; Restrict who can run QuotaAdvisor reports until the product is removed..
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2000-0928 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- quotaadvisor-list-files(5327)CVE reference · vdb-entry, x_refsource_XF
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.