CVE-1999-0910: Microsoft Commercial Internet System

Medium severity, CVSS 5.0. EPSS: 5.8% chance of exploitation in the next 30 days.

Microsoft Site Server and Commercial Internet System (MCIS) do not set an expiration for a cookie, which could then be cached by a proxy and inadvertently used by a different user.

Affected products

• Microsoft Commercial Internet System: version 2.0 only; version 2.5 only
• Microsoft Site Server: version 3.0 only
• Microsoft Site Server Commerce: version 3.0 only

Published 1999-09-10. Last modified 2026-06-16.