PT-2000-1678 · Microsoft · Iis

Publicado 2000-10-20 · Atualizado 2018-10-30 · CVE-2000-0746

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IIS versions 4.0 through 5.0

Description The issue allows a malicious web site operator to embed scripts in a link to a trusted site. These scripts are returned without quoting in an error message back to the client, which then executes them in the same context as the trusted site.

Recommendations For IIS versions 4.0 through 5.0, consider disabling the error message feature that returns unquoted scripts to minimize the risk of exploitation. Restrict access to potentially vulnerable web pages to minimize the risk of cross-site scripting attacks.

Correção

Identificadores relacionados

CVE-2000-0746

Produtos afetados

Iis

Referências · 6

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0746 · Nota
• http://securityfocus.com/bid/1594 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2000-0746 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-060 · Nota
• http://securityfocus.com/templates/archive.pike?list=1&msg=39A12BD6.E811BF4F%40nat.bg · Nota
• http://securityfocus.com/bid/1595 · Aviso do Fabricante