A vulnerability exists in Microsoft Internet Information Server (IIS) which could disclose sensitive information contained in CGI-type files. Typically a CGI/script file on a web server should only be executable and not readable by remote users. Sensitive information contained in such a file might include user credentials for access to a back-end database.