PT-2003-1695 · Microsoft · Internet Security/Acceleration (Isa) Server 2000

Brett Moore

·

Publicado

2003-07-17

·

Atualizado

2018-10-12

·

CVE-2003-0526

CVSS v2.0

6.8

Média

VetorAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions: Microsoft Internet Security and Acceleration (ISA) Server 2000
Description: A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script via a URL containing the script in the domain name portion. This occurs because the default error pages, specifically 500.htm for "500 Internal Server error" and 404.htm for "404 Not Found," do not properly cleanse the input.
Recommendations: For Microsoft Internet Security and Acceleration (ISA) Server 2000, consider modifying the default error pages 500.htm and 404.htm to properly cleanse input and prevent the injection of arbitrary web scripts. As a temporary workaround, restrict access to these error pages to minimize the risk of exploitation.

Exploit

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2003-0526

Produtos afetados

Internet Security/Acceleration (Isa) Server 2000